Flash爆發0天高危漏洞請立即更新FlashPlayer

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">有數百位Gmail用戶帳號遭到入侵

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">雖然Google說這並不是因為Gmail的漏洞所導致

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">但一些人依然認為是Gmail漏洞問題

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">到了今天問題已經明朗了

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">問題的源頭正是<a style="outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 13px; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; color: #027ac6; text-decoration: none; background-position: initial initial; background-repeat: initial initial; padding: 0px; margin: 0px; border: 0px initial initial;" href="http://www.adobe.com/support/security/bulletins/apsb11-13.html" target="_blank">Adobe Flash所導致 ！

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">受影響的版本有OS X, Linux, Windows, Solaris上的Flash 10.3.181.16及舊版

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">Android平台上的Flash 10.3.185.22及舊版

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">它攻擊的方式是由一封釣魚郵件開始

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">信件的內容利用誘拐的方式

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">欺騙使用者點擊了一個連結

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">而這個連接會開啟一個Flash檔

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">使用Flash的Redirect對Gmail進行偽造的跨站請求

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">並且在這個過程中轉介到攻擊者本身的信箱當中

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">該樣本目前已經被提取，由於使用DoSWF方式加密目前還無法解密，但攻擊手法已經確定

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">建議Google或其他同質性服務的公司

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">應該修改認證程序，在轉介新的授權信箱時

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">要求使用者動手重新再輸入一次密碼

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">如此這類自動授權的問題將可被有效斷絕

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">目前Adobe已經釋出了更新版

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">還有Chrome內建Flash的更新版

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">強烈建議馬上進行更新

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;">以免遭到攻擊

<p style="margin-top: 0px; margin-right: 0px; margin-bottom: 0.83em; margin-left: 0px; outline-width: 0px; outline-style: initial; outline-color: initial; font-size: 1em; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: transparent; font-family: Helvetica, Arial, FreeSans, sans-serif; line-height: 1.5em; background-position: initial initial; background-repeat: initial initial; padding: 0px; border: 0px initial initial;"> http://bbs.cool3c.com/article/47131

pcwiki的部落格

歡迎光臨pcwiki在痞客邦的小天地