Adobe fixes ClickJacking flaw
Adobe last week released Flash 10 and also warned that a critical vulnerability meant that earlier versions of Flash allowed attackers to bypass security controls.
The risk, known as ClickJacking(http://mybroadband.co.za/news/Internet/5590.html), can be used to allow an attacker to trick a user into clicking on, and following, links to external sites. The technique is based on a browser’s ability to include content from another page in the content of a trusted page.
Unlike most browser flaws which affect one or other release of a browser, ClickJacking affects all popular browsers including Internet Explorer, Firefox, Opera, Safari and Google’s Chrome.
The upgraded Flash player also includes fixes that can aid in preventing a Clickjacking attack on a Flash Player user’s camera and microphone, the company said.
"This update includes further changes to enhance Flash Player’s interpretation of cross-domain policy files. These changes could help prevent privilege escalation attacks against web servers hosting Flash content and cross-domain policy files."
Users are urged to upgrade from previous versions of the Flash player to at least version 10.0.12.36.
Adobe Flash clickjacking discussion
Loading ...