CVE-2010-3636

Vulnerability

Adobe Flash Player versions before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file. This allows remote web servers to bypass intended access restrictions via unknown vectors [1].

Exploitation

An attacker can craft a malicious cross-domain policy file with a specific encoding that is mishandled by the vulnerable Flash Player. When a user loads content from the attacker's domain, the policy file is parsed incorrectly, potentially granting the Flash application cross-domain access that should be blocked. The attacker requires no authentication and only needs to serve the policy file from a web server.

Impact

Successful exploitation allows an attacker to bypass the same-origin policy, enabling unauthorized cross-domain data access. This could lead to information disclosure, data manipulation, or other attacks that depend on cross-domain interaction.

Mitigation

Adobe released updates to Flash Player 9.0.289.0 and 10.1.102.64 for desktop platforms, and 10.1.95.1 for Android, to address this issue. Users should upgrade to these versions or later. For systems where updating is not possible, consider disabling Flash Player or using browser security settings to restrict Flash execution. Affected vendors have issued advisories [1][2][3][4].