Possible Flash Vulnerability! (PUBLIC SERVICE ANNOUNCEMENT)

[keyclone]

<edit>VYNDREE'S EDIT: I moved some threads from an derailed topic in here so they're more visible. They are a bit screwy with the timeline, though. </end edit>

the video file on the main site (with the 5 mages) is being served by youtube from the youtube site. if you have something different locally, you might want to check your system. (i'm not getting any AV hits for this)

edit: vyndree, i'm thinking your system may be infected instead of every video file coming down

[Vyndree]

http://dual-boxing.com/forums/index....292#post154292

Although... Hmm... I was going to link the official keyclone website but KC might want to take a look at his site. I'm picking up "Actns/Swif.T detected in a .swf file..." when visiting http://solidice.com/keyclone -- I don't think it's KC... I think it's Youtube. O.o SWF = Flash file, and the only flash on his site is the video guides via Youtube.



EDIT: Curious, b/c I don't seem to get any notifications for http://www.youtube.com/watch?v=-Ev7wuPSkl0 (which I had a hunch was firing off the virus on the main page...) Of course, the embedded youtube flash is different than the one on youtube.com so...?

EDIT: Confirmed! I visited a page on my own vboxing.net that had a youtube video embedded in it, and got the same virus notification. Be wary, folks! Any site with an embedded youtube video should be suspect!

Please be aware that, via experimentation, I think there's a flash vulnerability for any youtube video that is embedded in an external (non- youtube.com) site. Youtube utilizes Flash to embed videos in websites -- they also use Flash on Youtube.com but it appears that the flash directly from the site is (thus far) clean.

I don't want to panic everyone, but I would like everyone to be aware so that they can act appropriately. Please make sure your Antivirus software is updated and running correctly.

[Vyndree]

the video file on the main site (with the 5 mages) is being served by youtube from the youtube site. if you have something different locally, you might want to check your system. (i'm not getting any AV hits for this)

edit: vyndree, i'm thinking your system may be infected instead of every video file coming down

I'm getting it from multiple PCs running Vista/IE8 and XP/IE7. Both are using ETrust antivirus and are throwing virus notifications on any site that contains a embedded youtube video. My embedded GameVee flash videos are not throwing any warnings.

Since I can repro on another machine, it's certainly not my system.

[Multibocks]

ah poop, now I gotta go buy some AV software. I never used it before as I always visit the same ("trusted") sites, but I guess that doesnt work (well it seemed to!)

[Eldi]

great what a good antivirus thats free. lol since all my machines dont run any anti virus.

[keyclone]

http://www.crunchgear.com/2008/12/02...-youtube-vids/

looks like another Internet Explorer virus...

[Ellay]

Confirmed here
http://www.crunchgear.com/2008/12/02...-youtube-vids/

Hopefully Youtube fixes this issue asap.

[Svpernova09]

What would be the steps to reproduce, I've not noticed any issues.

Firefox 3.0.4: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4 (.NET CLR 3.5.30729)
Windows XP SP2
AVG 8.0.176 Definitions: 270.9.12/1824

[Vyndree]

[quote='Svpernova09',index.php?page=Thread&postID=1 54316#post154316]What would be the steps to reproduce, I've not noticed any issues.

Firefox 3.0.4: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4 (.NET CLR 3.5.30729)
Windows XP SP2
AVG 8.0.176 Definitions: 270.9.12/1824[/quote]

From [url='http://www.crunchgear.com/2008/12/02/actnsswift-virus-affecting-embedded-youtube-vids/']KC/Ellay's link[/url], it's an embedded youtube video in an external site while using IE.

I moved some replies from the derailed thread in here, they're a little mixed up in the timeline. :P

[Duane]

great what a good antivirus thats free. lol since all my machines dont run any anti virus.

I've used the free version of AVG for years with no problems. Tends to be less of a memory hog than some of the others as well.