sincity Posted July 9, 2014 Share Posted July 9, 2014 A Swiss Google engineer, Michele Spagnuolo, has managed to come up with a tool that exploits three characteristics of Adobe's Flash and JSONP (JavaScript Onject Notation with padding). In a blog post, he wrote: "I present Rosetta Flash, a tool for converting any SWF file to one composed of only alphanumeric characters in order to abuse JSONP endpoints, making a victim perform arbitrary requests to the domain with the vulnerable endpoint and exfiltrate potentially sensitive data, not limited to JSONP responses, to an attacker-controlled site". Best free antivirus software 2014 Sites affected by the flaw that have been known to be impacted by the flaw include Google itself, Youtube, Twitter, Instagram, Tumblr and Ebay. It is likely that they will have all, by now, fixed the flaw and everyone is urged to download updates for their respective browsers. Spagnuolo has uploaded Rosetta Flash to Gitbub while Adobe has issued an official statement saying that "These [...] vulnerabilities [...] could potentially allow an attacker to take control of the affected system" Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.