lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed Jun  7 11:34:15 2006
From: compromise at gmail.com (Xavier)
Subject: Flash adverts and XSS (clickTAG revisited)

Greetings,

It seems that high profile sites (the likes of MySpace, Xanga, Heiss,
CNN, Yahoo, CNET, FOX, OSTG Network / Slashdot, etc)  are allowing
advertisers to distribute vulnerable Flash objects on their user
pages.

The problem is in a generic user "click tracker" code provided by
Macromedia some odd years ago that has been recycled and redistributed
as time went on. Let me point out that this vulnerability is _nothing
new_ in fact it was reported three years ago:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2003-0208

The reason why the vulnerable code is still affecting a large number
of sites today is because with time it seems advertisers have recycled
their own examples and thus created a network of disinformation. Adobe
has an updated version of the clickTAG guide here:
http://www.adobe.com/resources/richmedia/tracking/designers_guide/

Vulnerable code:
on (release)
{
    getURL(clickTag, "_top");
}

(In the ActionScript code shown above the "clickTag" variable is not sanitized.)

The getURL() function is capable of opening up HTTP pages using GET
(and POST), it can open up FTP connections, and finally execute
JavaScript code. In a situation where an advertiser uploads a
vulnerable Flash file to your server, then proceeds to embed it into
the user pages, a vector of attack is opened; Cross Site Scripting.

Further information, including PoCs, can be found at the following
reference: http://xavsec.blogspot.com/2006/06/your-space-my-flash-his-cookies.html

regards,
Xavier.

Powered by blists - more mailing lists