Nieuwe exploit in Flash-player direct misbruikt

[mindcrash]

Wellicht kan in dit artikel een update worden geplaatst in verband met de volgende reactie van Adobe (om precies te zijn van Adobe's Product Security Incident Response Team):

Here’s a quick update on our progress investigating the recent reports of a potential Flash Player exploit in the wild. The exploit appears to be taking advantage of a known vulnerability, reported by Mark Dowd of the ISS X-Force and wushi of team509, that was resolved in Flash Player 9.0.124.0 (CVE-2007-0071). This exploit does NOT appear to include a new, unpatched vulnerability as has been reported elsewhere – customers with Flash Player 9.0.124.0 should not be vulnerable to this exploit. We’re still looking in to the exploit files, and will update everyone with further information as we get it, but for now, we strongly encourage everyone to download and install the latest Flash Player update, 9.0.124.0.

Bron

Overigens wordt hetzelfde gemeld door het Security Bulletin van CERT die in het artikel gequote wordt:

This issue has been addressed in the most recent version (9.0.124.0) of Adobe Flash. Microsoft Windows users should browse to the Adobe Flash Player Support Center downloads and install the most recent version of Flash site using Internet Explorer, then repeat the process for all other installed browsers (Firefox, Opera, Safari, etc). Systems that are not running Windows should be updated by going to the Adobe Flash Player Support Center downloads and installing the most recent version of Flash with all each web browser on the system.

[ Voor 28% gewijzigd door mindcrash op 29-05-2008 00:36 . Reden: info van CERT toegevoegd + link naar artikel (net zo handig...) ]

[Dimitri R]

Update geplaatst en tnx!