Massive Flash flaw affects Google, YouTube, Twitter

And Instagram, Tumblr, eBay

A Swiss Google engineer, Michele Spagnuolo, has managed to come up with a tool that exploits three characteristics of Adobe's Flash and JSONP (JavaScript Onject Notation with padding).

In a blog post, he wrote: "I present Rosetta Flash, a tool for converting any SWF file to one composed of only alphanumeric characters in order to abuse JSONP endpoints, making a victim perform arbitrary requests to the domain with the vulnerable endpoint and exfiltrate potentially sensitive data, not limited to JSONP responses, to an attacker-controlled site".

Sites affected by the flaw that have been known to be impacted by the flaw include Google itself, YouTube, Twitter, Instagram, Tumblr and Ebay. It is likely that they will have all, by now, fixed the flaw and everyone is urged to download updates for their respective browsers.

Spagnuolo has uploaded Rosetta Flash to Gitbub while Adobe has issued an official statement saying that "These [...] vulnerabilities [...] could potentially allow an attacker to take control of the affected system"

ABOUT THE AUTHOR

Editor, TechRadar Pro

Désiré (Twitter, Google+) has been musing and writing about technology since 1997. Following an eight-year stint at ITProPortal.com where he discovered the joys of global techfests, developing an uncanny attraction for anything silicon, Désiré now heads up TechRadar Pro.