A newly discovered flaw in the Flash suite could put both users and servers at risk, according to some recent reports. Adobe has verified the hole, which lies inside any Flash-based application that allows people to upload their own content. Though some details are omitted, the flaw would allow someone to upload a malicious Flash object to a site, which in turn would be downloaded and processed by people visiting the site. According to one security expert, any site relying on user uploads through Flash could be vulnerable.
This isn’t the first severe flash flaw to emerge this year. Only a few months ago, a “critical” vulnerability was discovered and published. Earlier in the year, Adobe was tackling a host of other security issues with Flash as well. This newly-discovered vulnerability could prove to be the worst yet — and it doesn’t help that Adobe is claiming the flaw is “unpatchable”. A solution must be discovered, but it may be something that has to happen on a developer, browser or OS level instead of through Flash.
The only current defense users can employ against such attacks is to stop using Flash, or failing that, restrict its use to sites known to be safe with tools such as the NoScript add-on for Mozilla’s Firefox, or ToggleFlash for Microsoft’s Internet Explorer.