Critical vulnerabilities have been identified in Adobe Flash Player 10.3.183.7 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.186.6 and earlier versions for Android. These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that one of these vulnerabilities (CVE-2011-2444) is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message. This universal cross-site scripting issue could be used to take actions on a user's behalf on any website or webmail provider if the user visits a malicious website.
http://www.adobe.com/support/security/bulletins/apsb11-26.html
----------------------------------------------------------------------------
Based on the limited information provided by Adobe above, I suspect this new vulnerability (CVE-2011-244) was used in a new series of targeted web e-mail (Gmail) attacks – just as was the case with the last Flash Universal XSS detected and patched out-of-band by Adobe in June 2011. Note in the Adobe advisory that CVE-2011-2444 is credited to Google. Coincidence?
According to Google, that June 2011 campaign against Gmail, appeared to originate from Jinan, China and affected what seem to be the personal Gmail accounts of hundreds of users including, among others, senior U.S. government officials, Chinese political activists, officials in several Asian countries (predominantly South Korea), military personnel and journalists.
In the same June timeframe, TrendMicro noted that in addition to Gmail, Hotmail and Yahoo! Mail were also been targeted. While the attacks appear to have been separately conducted, these have some significant similarities.
No comments:
Post a Comment