Serious Flash vulns menace at least 10,000 websites

[InfoSec News <alerts () infosecnews org>]

http://www.theregister.co.uk/2007/12/21/flash_vulnerability_menace/

By Dan Goodin in San Francisco
The Register
21st December 2007

Researchers from Google and a well-known security firm have documented 
serious vulnerabilities in Adobe Flash content which leave tens of 
thousands of websites susceptible to attacks that steal the personal 
details of visitors.

The security bugs reside in Flash applets, the ubiquitous building 
blocks for movies and graphics that animate sites across the web. Also 
known as SWF files, they are vulnerable to attacks in which malicious 
strings are injected into the legitimate code through a technique known 
as cross-site scripting, or XSS. Currently there are no patches for the 
vulnerabilities, which are found in sites operated by financial 
institutions, government agencies and other organizations.

The vulnerabilities are laid out in the book Hacking Exposed Web 2.0: 
Web 2.0 Security Secrets and Solutions [1]. It is due to hit store 
shelves soon, but is already in the hands of many security 
professionals. The book's authors, who work for penetration testing firm 
iSEC Partners as well as for Google, say a web search reveals more than 
500,000 vulnerable applets on major corporate, government and media 
sites.

"Lots of people are vulnerable, and right now there are no protections 
available other than to remove those SWFs and wait for the authoring 
tools and/or Flash player to be updated," says Alex Stamos, one of the 
book's authors. "In the mean time, people will have to think: 'What kind 
of flash am I using on my site,' and manually test for vulnerabilities."


Flash flood

That could be a mammoth task, because a half-dozen of the most popular 
Flash authoring programs automatically generate the buggy content. 
What's more, the people who crank out graphics frequently work 
separately from a site's security team. Removing the vulnerable content 
will require combing through website directories for SWF files and then 
testing them one by one. Updates in the Adobe software that renders SWF 
files in browsers are also expected, but they probably wouldn't quell 
the threat completely, according to Stamos.

The authors have been working since the summer with Adobe, the developer 
of Flash, and the United States Computer Emergency Readiness Team to 
coordinate a remedy. An Adobe representative said patches should be 
released in the next few weeks. In the meantime, end users can employ 
the Firefox plug-in NoScript or use other methods to block Flash on 
sensitive websites. Flash content creators can also utilize the data 
validation libraries found here, as well as follow the guidelines of 
this Adobe whitepaper.

A security update Adobe released this week for its Flash player doesn't 
fix the vulnerabilities, Stamos said.

Attack scenarios work something like this: A bank website hosts 
marketing graphics in the form of a vulnerable Flash applet. Attackers 
who trick a customer into clicking on a malicious link are able to 
execute the SWF file but inject malicious code variables that cause the 
customer's authentication cookies or login credentials to be sent to the 
attacker.

"There are definitely lots of people who are vulnerable," Stamos said. 
"Tens of thousands is very conservative. Realistically, it's probably in 
the hundreds (of thousands)."


Shockwave to the system

One reason for the sheer volume of vulnerable applets: SWF files 
generated by six of the more popular content development tools 
automatically contain the bugs, according to the book. Those programs 
include DreamWeaver, Connect, Breeze - which are sold by Adobe - and 
TechSmith Camtasia, InfoSoft FusionCharts and software from Autodemo.

Stamos said Adobe is likely to update its Flash Player so it does a 
better job of vetting code variables before executing SWF files. But he 
said interaction with third-party code is such a core part of the way 
Flash works that updates to the player would likely provide only a 
partial fix.

Eradicating the problem will require updates for all of the graphics 
authoring tools so they no longer generate buggy Flash content. Even 
then, security pros will have to analyze all of a website's SWF files 
and recompile any found to be vulnerable.

The book was authored by Rich Cannings, a senior information security 
engineer at Google, and Himanshu Dwivedi, Zane Lackey, Chris Clark and 
Stamos of iSEC. It is published by The McGraw-Hill Companies.

[1] http://www.amazon.com/exec/obidos/ASIN/0071494618/c4iorg
and http://www.shopinfosecnews.org


__________________________________________________________________      
Visit InfoSec News
http://www.infosecnews.org/