Ouch!, There's an 0day for Adobe flash player latest version and older. Currently there's no patch. Attackers are exploiting this in the wild. I can say this for a fact since for the past week or so, I've been monitoring a server hosted in China as part of an ongoing investigation in my company. The malicious site updates their malicious code almost daily and today I've noticed that they included what appears to be the new exploit for the Adobe flash player.

For example:

hxxp://www.woai###.cn/4562.swf

There's also seems to be a massive sql injection attack inserting malicious code that automatically redirect users without their consent to this malicious file or other similar swf files.

So my friends be careful out there in cyberspace and don't visit untrusted websites. Update your anti-virus software and if possible I would suggest setting a killbit for the flash player or adding a rule to your perimeter devices to block swf files until there is an official patch. Also NoScript is your best friend.

Additional info concerning this issue:

http://isc.sans.org/diary.html?storyid=4465
http://isc.sans.org/diary.html?storyid=4468
http://www.securityfocus.com/bid/29386/info
http://news.cnet.com/8301-10789_3-9952547-57.html?tag=nefd.top

Nice update post on PC Mag by Larry Seltzer:

http://blogs.pcmag.com/securitywatch/2008/05/flash_vulnerability_update.php

Don