Adobe patches prevent cross-site scripting attacks via Flash

Staff Writer

Adobe on Wednesday released two patches to protect against cross-site scripting (XSS) attacks.


The San Jose, Calif.-based productivity application vendor patched vulnerabilities in Connect Enterprise Server 6, Dreamweaver versions CS3 and 8, and Contribute CS3 and 4 to fix issues that can allow XSS attacks on end-users' PCs.

One flaw, caused by input validation errors in Dreamweaver and Contribute, affects users who have installed the Insert Flash Video command.

Adobe credited Google security researcher Rich Cannings with reporting both flaws, which can be found in Shockwave Flash files on websites.

Cannings told SCMagazineUS.com earlier this month that there are hundreds of thousands of vulnerable SWF files on the web.

Cannings and an Adobe representative could not be immediately reached for comment.

Jeremiah Grossman, chief technology officer at WhiteHat Security, told SCMagazineUS.com today that XSS is “the No. 1 type of vulnerability out there now.”

“There are many Flash files out there that are vulnerable to this type of attack. There are thousands, and potentially hundreds of thousands of them, and they're all going to have to be rebuilt,” he said. “[The patch] was the vendor-side problem, but they're going to have to wait for the website owners and the website creators to catch up with them.”
Got a news tip for our journalists? Share it with us anonymously here.
Tags:

Most Read Articles

CBA using facial recognition logins to verify disputed payments

CBA using facial recognition logins to verify disputed payments

Qantas contacted by "potential cyber criminal"

Qantas contacted by "potential cyber criminal"

SA Power Networks tackles IAM, cloud security under five-year strategy

SA Power Networks tackles IAM, cloud security under five-year strategy

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Log In

  |  Forgot your password?