Date: 19 Aug 2003 20:50:18 -0000
From: Jennifer Taylor <jetaylor@...romedia.com>
To: bugtraq@...urityfocus.com
Subject: MPSB03-05 Patch and Work Around for Dreamweaver MX, DRK, and
    UltraDev Server Behaviors


In-Reply-To: <200308041508.h74F824G026875@...appc.com>

Thank you again for bringing this to the attention of Macromedia.  The 
issues have been resolved.  More information and the necessary patches 
are available at:  http://www-
staging.macromedia.com/devnet/security/security_zone/mpsb03-05.html 

MPSB03-05 Patch and Work Around for Dreamweaver MX, DRK, and UltraDev 
Server Behaviors 

Originally posted: August 19, 2003
Last updated: August 19, 2003 

Summary
Recently, Macromedia became aware of a security issue with some of the 
server behaviors present in Dreamweaver MX, all versions of UltraDev, and 
two extensions that shipped as part of the Developer’s Resource Kit 
(DRK), vol. 2 and vol. 4. If exploited, it is possible for an attacker to 
gain access to certain site-specific cookie and session information. 

Solution
Macromedia has issued downloadable patches for Dreamweaver MX and the 
effected Developers Resource Kit Extensions. These fixes will be 
incorporated into all future releases of Dreamweaver. After updating your 
product, you will need to reapply the server behaviors to the pages that 
use them, and redeploy those pages to your server. To download the 
patches for Dreamweaver MX and the effected Developers Resource Kit 
Extensions, please visit TechNote 18838 (http://www-
staging.macromedia.com/support/dreamweaver/ts/documents/security_update_08
03.htm).

For information on how to resolve this issue in UltraDev please visit 
TechNote 18839 (http://www-
staging.macromedia.com/support/ultradev/ts/documents/security_update_0803.
htm).

For concerns or questions regarding this specific security bulletin, 
please email: DWMPSB0305@...romedia.com.

Severity Rating
Macromedia categorizes this issue as an important update and recommends 
that users update their product with the respective patch. 

Issue
Macromedia has learned that the behavior issues, present in Dreamweaver 
MX, all versions of UltraDev, and two extensions included as part of the 
DRK vol. 2 and vol. 4, contain a flaw that if exploited may allow an 
attacker to gain access to certain site-specific cookie and session 
information. This situation arises because the server behavior uses a 
redirect based on a variable, but the variable is not URL encoded. This 
allows an attacker to write script which may ultimately be executed on a 
user's browser.

Since the script is still subject to normal browser security, this 
vulnerability does not allow arbitrary access to the data on the users’ 
machine, nor allow arbitrary code to run. Further, this does not allow 
access to information on the server, nor does it allow any code to be 
executed on the server.

For a list of behaviors affected in Dreamweaver/DRK Server Behaviors, 
please visit TechNote 18838 (http://www-
staging.macromedia.com/support/dreamweaver/ts/documents/security_update_08
03.htm).

For a list of behaviors affected in UltraDev, please visit TechNote 18839 
(http://www-
staging.macromedia.com/support/ultradev/ts/documents/security_update_0803.
htm).

Revisions
Bulletin first released on August 19, 2003. 

Reporting Security Issues
Macromedia is committed to addressing security issues and providing 
customers with the information on how they can protect themselves. If you 
identify what you believe may be a security issue with a Macromedia 
product, please send an email to secure@...romedia.com. We will work to 
appropriately address and communicate the issue.

Receiving Security Bulletins
When Macromedia becomes aware of a security issue that we believe 
significantly affects our products or customers, we will notify customers 
when appropriate. Typically this notification will be in the form of a 
security bulletin explaining the issue and the response. Macromedia 
customers who would like to receive notification of new security 
bulletins when they are released can sign up for our security 
notification service. 

For additional information on security issues at Macromedia, please visit 
the Security Zone at: 
http://www.macromedia.com/security.

ANY INFORMATION, PATCHES, DOWNLOADS, WORKAROUNDS OR FIXES PROVIDED BY 
MACROMEDIA IN THIS BULLETIN ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY 
KIND. MACROMEDIA AND ITS SUPPLIERS DISCLAIM ALL WARRANTIES, WHETHER 
EXPRESS OR IMPLIED OR OTHERWISE, INCLUDING THE WARRANTIES OF 
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. ALSO, THERE IS NO 
WARRANTY OF NON-INFRINGEMENT, TITLE OR QUIET ENJOYMENT. (USA ONLY) SOME 
STATES DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO THE ABOVE 
EXCLUSION MAY NOT APPLY TO YOU.

IN NO EVENT SHALL MACROMEDIA, INC. OR ITS SUPPLIERS BE LIABLE FOR ANY 
DAMAGES WHATSOEVER INCLUDING, WITHOUT LIMITATION, DIRECT, INDIRECT, 
INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, COVER, LOSS OF PROFITS, 
BUSINESS INTERRUPTION OR THE LIKE, OR LOSS OF BUSINESS DAMAGES, BASED ON 
ANY THEORY OF LIABILITY INCLUDING BREACH OF CONTRACT, BREACH OF WARRANTY, 
TORT(INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR OTHERWISE, EVEN IF 
MACROMEDIA, INC. OR ITS SUPPLIERS OR THEIR REPRESENTATIVES HAVE BEEN 
ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. (USA ONLY) SOME STATES DO NOT 
ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR 
INCIDENTAL DAMAGES, SO THE ABOVE EXCLUSION OR LIMITATION MAY NOT APPLY TO 
YOU AND YOU MAY ALSO HAVE OTHER LEGAL RIGHTS THAT VARY FROM STATE TO 
STATE.

Macromedia reserves the right, from time to time, to update the 
information in this document with current information. 

Powered by blists - more mailing lists