CVE-2014-0503

Vulnerability

Adobe Flash Player versions prior to 11.7.700.272 and 12.0.0.77 on Windows and OS X, and prior to 11.2.202.346 on Linux, contain a vulnerability that allows remote attackers to bypass the Same Origin Policy via unspecified vectors [1][2]. The exact mechanism is not disclosed, but it likely involves crafted SWF content that circumvents security restrictions.

Exploitation

An attacker can exploit this vulnerability by enticing a user to open a specially crafted SWF file, for example by hosting it on a malicious website or embedding it in an email [2]. No authentication is required, and the attack relies on user interaction. The unspecified vectors suggest that the bypass can be triggered through standard Flash content delivery.

Impact

Successful exploitation allows an attacker to bypass the Same Origin Policy, potentially enabling the reading of data from other origins [1][2]. This could lead to information disclosure, such as accessing cross-origin resources or sensitive data from other websites. The scope is limited to the context of the Flash Player plugin.

Mitigation

Adobe has released updated versions that fix this vulnerability: 11.7.700.272, 12.0.0.77 for Windows and OS X, and 11.2.202.346 for Linux [1][2]. Users should update their Flash Player installations to these or later versions. No workarounds are available.