Page is a not externally linkable
- Code, Content, and Presentation
-- Flash and Shockwave
---- Web Developers, Fix your Insecure Flash


RonPK - 10:18 pm on Mar 30, 2008 (gmt 0)


Please note that the list of authoring tools does not include Flash. From the Google Docs document:

Critical vulnerabilities exist in a large number of widely used web authoring tools that automatically generate Shockwave Flash (SWF) files, such as Adobe (r) Dreamweaver (r), Abobe Contribute (r), Adobe Acrobat (r) Connect (tm) (formerly Macromedia Breeze), InfoSoft FusionCharts, and Techsmith Camtasia. The flaws render websites that host these generated SWF files vulnerable to Cross-Site Scripting (XSS).

This problem is not limited to authoring tools. [beep], a popular service provider, used a vulnerable controller SWF in many of their projects.

It seems that if you used Flash to create your .swf files, you're safe.


Thread source:: http://www.webmasterworld.com/flash/3614699.htm
Brought to you by WebmasterWorld: http://www.webmasterworld.com