Is it actually a flaw in the Bitcoin protocol, or something wrong with Gox's software?
Allowing fraud? Thats exclusively a problem with Gox's transaction handling practices and really has little to do with malleability (which is a long known, usually minor, issue in Bitcoin which is slowly being fixed).
The issue is that fraud is made possible by _failing_ to double-spend when you cancel or reissue a transaction. If you do correctly double-spend then the fraud cannot occur regardless of the malleability. If you don't, it can occur, again with or without malleability.
See also:
http://sourceforge.net/mailarchive/forum.php?thread_name=CAAS2fgTx8UzQiocyNMfMNkt2uUZRTmhagb2BY9TPuAupVjVa2g%40mail.gmail.com&forum_name=bitcoin-developmentThe malleability issue seems real enough. Something was published on it on 21 january on bitcoin.it, maybe someone had to try it out
21 January
2013And you'll note that page is citing a forum thread from 2011. Bitcoin v0.8 rolled out the first round of fixes to eventually remove malleability way back then too... and we've seen bouts of amounts of malleability use on the network, back in 2012 if not sooner I haven't grepped my logs.