Does the presence of a flash banner inherently open the site up to exploits, or is there a way to ensure the flash banner does not have "access" to anything important on the page.
The page in question is a log-in page.
Webmasters Stack Exchange is a question and answer site for pro webmasters. It only takes a minute to sign up.Sign up to join this community
As an end user, the simple answer to this is "just don't allow the banner to run." The term "banner" suggests to me that the applet is nonessential, i.e. blocking it wouldn't prevent the page from working.
As a webmaster, the obvious answer is to just accept that Flash is dead and remove the applet, as 90% of your users are not going to see it anyways unless you create a tutorial for them on how to go into their browser settings and re-enable flash and/or instruct them to allow the applet. Any tutorial materials you make will only work for the next 11 months anyways, until Flash leaves the browser for good.
For context, modern browsers are either single or double opt-in when it comes to Flash nowadays - they don't just run it automatically due to security concerns:
Chrome both requires Flash to be explicitly enabled in settings, then also enabled on a site-by-site basis. It will be removed entirely by December 2020.
Firefox requires Flash to be explicitly enabled on both a site-by-site basis, and also on an applet-by-applet basis, and Flash will be removed entirely by December 2020.
Edge requires Flash to be enabled on a site-by-site basis, and, you guessed it, support will be removed by December 2020.
Flash support for mobile browsers is rare - only less popular alternative browsers support it to my knowledge.
To answer your question directly, I wouldn't currently trust Flash to be secure. As its usage continues to decline, that means it has fewer and fewer eyes on it looking for security vulnerabilities, and major vulnerabilities such as arbitrary code execution have been discovered as recently as 2019. On the other hand Flash is client-side code, though, so to the best of my knowledge, any potential exploit would be limited to the context of the pwned user's machine. In other words, there's no way for an attacker to automatically "make the jump" and compromise the server, too, unless they find a separate server-side exploit to chain it with.
But this is only an issue if the user chooses to enable Flash in their browser settings, then explicitly allow the banner applet on your site to run. It doesn't make any sense to me to make a user jump through those hoops to enable a nonessential part of the page, therefore it makes more sense in my opinion to just remove the Flash applet.
On the other hand, if the banner actually is essential to the functioning of the page, then, well, there's also probably not much you can do to fix it besides rewrite the functionality without using Flash.