Flash attack compromises 20,000 websites

Flash attack compromises 20,000 websites

Summary: Symantec has warned of websites being compromised by Chinese domains hosting an exploit for an unpatched Adobe Flash Player flaw

TOPICS: Security

Approximately 20,000 websites have been compromised with code that could allow a user's system to be exploited remotely, Symantec security researchers have warned.

The attacks, which began on Tuesday, originally involved two Chinese sites hosting exploits for the flaw: wuqing17173.cn and woai117.cn. Further analysis by Symantec indicated another domain involved: dota11.cn.

Malicious code is being injected into third-party domains, probably through SQL-injection attacks. The code then redirects users to sites hosting malicious Flash files, according to an advisory on Symantec's SecurityFocus site.

The code exploits a flaw in Adobe Flash Player version, and may affect, said Symantec. Other versions of Flash Player may also be affected, Symantec warned. The flaw, which appears to be a buffer overflow vulnerability, occurs when Flash Player processes a malicious Shockwave Flash (SWF) file. Normally SWF files contain animations or interactive applications.

An attacker can use the Flash files to execute whatever code they like (arbitrary code) on the system remotely. Even failed exploit attempts would probably lead to denial-of-service conditions, according to Symantec.

The Sans Institute has reported a further attack, involving the play0nlnie.com domain. The attack generates URLs designed to target specific Flash version and browser combinations, including Internet Explorer and Firefox.

There are no vendor patches as yet. However, the Adobe Product Security Incident Response Team is investigating the issue, according to a blog post.

Update: Following the posting of this article, the Adobe Product Security Incident Response Team issued this statement:

"This exploit appears to be taking advantage of a known vulnerability, reported by Mark Dowd of the ISS X-Force and wushi of team509, that was resolved in Flash Player (CVE-2007-0071). We strongly encourage everyone to download and install the latest Flash Player update,"

Topic: Security

Tom Espiner

About Tom Espiner

Tom is a technology reporter for ZDNet.com. He covers the security beat, writing about everything from hacking and cybercrime to threats and mitigation. He also focuses on open source and emerging technologies, all the while trying to cut through greenwash.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.


Log in or register to join the discussion
  • Flash attack compromises 20,000 websites.

    Is this cross platform, or does it only affect a windoze based system?
  • This affects all platforms

    Hi there ator,

    This issue affects all platforms:


    However, please note the update: Adobe is recommending that people download Flash Player, as it apparently is not affected:


    Best wishes,

    Tom Espiner
  • Flash attack

    Hi Tom;
    According to the Adobe page, it requires used interaction.
    "A malicious SWF must be loaded in Flash Player by the user for an attacker to exploit these potential vulnerabilities."
    My personal site is flash, and I was a little concerned, but it appears I have little to worry about.