According to Paul Royal, Purewire's chief researcher, the vulnerability that Adobe has acknowledged exists in some of its Reader, Flash Player, and Acrobat products, is being exploited by way of a malicious Flash code in Web pages - with the mentioned Flash flaw entrenched in the Web sites as multimedia.

Royal's latest warning about the Abode Flash flaw follows the earlier reports that the vulnerability is also being exploited through a malicious PDF file attack, which can likely lead to the virtual collapse of the Windows, Macintosh, and Linux operating systems.

Describing the attack, Royal said that it includes "a Flash movie of one-frame length. This malicious Flash file is being embedded in Web pages, sometimes of legitimate Web sites that are compromised."

The observation by Royal that several malicious sites are serving up Flash-based attacks, has been substantiated by SANS' Internet Storm Center, which said: "We have confirmed that the links have been injected in legitimate web sites to create a drive-by attack, as expected."

Royal also said that Adobe's own bug-tracking database indicates that the company knows of the vulnerability for almost seven months. However, it was on Wednesday that a security advisory was posted by Abode, going thus: "A critical vulnerability exists in the current versions of Flash Player for Windows, Macintosh and Linux operating systems, and the authplay. dll component of Adobe Reader and Acrobat v9. x."