From: InfoSec News (alertsinfosecnews.org)
Date: Thu May 14 2009 - 00:15:54 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

http://www.theregister.co.uk/2009/05/14/adobe_xss_bug/

By Dan Goodin in San Francisco
The Register
14th May 2009

More than 16 months after researchers warned that critical
vulnerabilities in Adobe Flash files leave websites vulnerable to
phishing and other serious attacks, a wide array of pages - some hosted
on Adobe.com itself - remain vulnerable.

The problem stems from buggy SWF files that generate banner ads and
other animated content. In December 2007, a team of researchers
discovered the files could be exploited by attackers to tamper with
websites belonging to banks, government agencies and other trusted
organizations. Over the next few months, the researchers repeatedly
warned webmasters the problem would be difficult to fix, because it
would require potentially millions of graphics files to be regenerated,
often from scratch.

Those warnings now appear to be prescient. As the website XSSed has
documented, even Adobe.com has failed to contain the offending SWF
files. Other offenders include the Marfin Egnatia Bank and Greek
electronics vendor Plaiso.gr. At time of writing, more than 24 hours
after the XSSed item was published, all three sites remained vulnerable.

"Anyone who includes one of those ads in their site is now susceptible
to cross-site scripting and some other things," said Jeff Williams, CEO
of web application security firm Aspect Security who reviewed the
posting. "It's definitely not good."

[...]

--
LayerOne 2009, Information Security for the discerning professional.
May 23-24 2009 The Anaheim Marriott in Anaheim, California
Visit http://layerone.info for more information

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]