Adobe patches Flash bug hackers are already exploiting

XSS bug similar to June flaw that attackers used to snatch Gmail passwords

Adobe on Wednesday patched six vulnerabilities in Flash Player, including one it admitted is already being exploited by attackers.

That vulnerability, identified as CVE-2011-2444, shares some traits with an earlier Flash flaw that was used to target Gmail accounts in June .

Adobe labeled CVE-2011-2444 as a cross-site scripting (XSS) vulnerability, a class of bugs often used by identity thieves to steal usernames and passwords from vulnerable browsers. In this case, browsers were not directly targeted; rather, attackers exploited the ubiquitous Flash Player browser plug-in.

Like the June Flash bug, CVE-2011-2444 was reported to Adobe by Google's security team.

Adobe also used almost identical phrasing to describe both CVE-2011-2444 and the June vulnerability in its security advisories.

"There are reports that this vulnerability is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message," said Adobe in Wednesday's advisory as well as the one it published in June. "This universal cross-site scripting issue could be used to take actions on a user's behalf on any website or webmail provider, if the user visits a malicious website."

Adobe declined to comment on how the CVE-2011-2444 vulnerability was being exploited and instead referred questions to Google. The latter did not immediately reply to an emailed query.

Four of the five other Flash bugs that Adobe patched today could be exploited by attackers to run their malicious code on victimized computers, Adobe said in its advisory.

Wednesday's Flash update was the first since Adobe patched 13 bugs on Aug. 9. Adobe has fixed Flash eight times so far this year, including several emergency, or "out-of-band," updates rushed to users because attacks were under way.

The patched versions of Flash Player for Windows, Mac, Linux and Solaris can be downloaded from Adobe's Web site. Alternately, users can run Flash's update tool or wait for the software to prompt them that a new version is available.

Android users must browse to the Android Market to update Flash.

Google silently updated its Chrome browser on Tuesday to include the patched version of Flash Player. Google has been including Flash with Chrome since April 2010, and remains the only browser maker to bundle the plug-in with its own releases.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed. His e-mail address is gkeizer@computerworld.com.

See more articles by Gregg Keizer.

Read more about security in Computerworld's Security Topic Center.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags applicationsGooglesecuritybrowserssoftwareMalware and Vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?