Adobe patches prevent cross-site scripting attacks via Flash

The San Jose, Calif.-based productivity application vendor patched vulnerabilities in Connect Enterprise Server 6, Dreamweaver versions CS3 and 8, and Contribute CS3 and 4 to fix issues that can allow XSS attacks on end-users' PCs.

One flaw, caused by input validation errors in Dreamweaver and Contribute, affects users who have installed the Insert Flash Video command.

Adobe credited Google security researcher Rich Cannings with reporting both flaws, which can be found in Shockwave Flash files on websites.

Cannings told SCMagazineUS.com earlier this month that there are hundreds of thousands of vulnerable SWF files on the web.

Cannings and an Adobe representative could not be immediately reached for comment.

Jeremiah Grossman, chief technology officer at WhiteHat Security, told SCMagazineUS.com today that XSS is “the No. 1 type of vulnerability out there now.”

“There are many Flash files out there that are vulnerable to this type of attack. There are thousands, and potentially hundreds of thousands of them, and they're all going to have to be rebuilt,” he said. “[The patch] was the vendor-side problem, but they're going to have to wait for the website owners and the website creators to catch up with them.”

adobeattackscrosssiteflashpatchespreventscriptingsecurityvia