lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed Jun 7 11:34:15 2006 From: compromise at gmail.com (Xavier) Subject: Flash adverts and XSS (clickTAG revisited) Greetings, It seems that high profile sites (the likes of MySpace, Xanga, Heiss, CNN, Yahoo, CNET, FOX, OSTG Network / Slashdot, etc) are allowing advertisers to distribute vulnerable Flash objects on their user pages. The problem is in a generic user "click tracker" code provided by Macromedia some odd years ago that has been recycled and redistributed as time went on. Let me point out that this vulnerability is _nothing new_ in fact it was reported three years ago: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2003-0208 The reason why the vulnerable code is still affecting a large number of sites today is because with time it seems advertisers have recycled their own examples and thus created a network of disinformation. Adobe has an updated version of the clickTAG guide here: http://www.adobe.com/resources/richmedia/tracking/designers_guide/ Vulnerable code: on (release) { getURL(clickTag, "_top"); } (In the ActionScript code shown above the "clickTag" variable is not sanitized.) The getURL() function is capable of opening up HTTP pages using GET (and POST), it can open up FTP connections, and finally execute JavaScript code. In a situation where an advertiser uploads a vulnerable Flash file to your server, then proceeds to embed it into the user pages, a vector of attack is opened; Cross Site Scripting. Further information, including PoCs, can be found at the following reference: http://xavsec.blogspot.com/2006/06/your-space-my-flash-his-cookies.html regards, Xavier.
Powered by blists - more mailing lists