CVE-2011-2458

Vulnerability

Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris, and before 11.1.102.59 on Android, as well as Adobe AIR before 3.1.0.4880, contain a cross-domain policy bypass vulnerability when used with Internet Explorer. The issue arises from improper enforcement of cross-domain policies, allowing a crafted website to bypass security restrictions [1].

Exploitation

An attacker can exploit this vulnerability by hosting a malicious website that, when visited by a user running Internet Explorer with an affected Flash Player or AIR version, causes the player to ignore cross-domain policy restrictions. No authentication or additional privileges are required; the user simply needs to browse to the attacker's site [1].

Impact

Successful exploitation allows the attacker to bypass the cross-domain policy, potentially enabling unauthorized reading of data from other domains. This could lead to information disclosure, such as stealing cookies or sensitive content from other websites, within the browser's security context [1].

Mitigation

Fixed versions include Adobe Flash Player 10.3.183.11, 11.1.102.55 (or 11.1.102.59 on Android), and Adobe AIR 3.1.0.4880. Users should upgrade to these or later versions. The Gentoo advisory recommends upgrading to >=11.2.202.228. No workaround is available [1].