[Full-disclosure] pacsec hype security advisory: seven words of warning about Flash player nine.

PacSec Hype Security Team Advisory:

"The new Flash player adds network functions!"


With a minor amount of fanfare "binary socket" support has been
added to Flash Player 9 / ActionScript 3.0. The Flash sandbox model
is primarily focused on preventing modifications to the local system,
and thus there are many ways to bypass the only-connect-back-upstream
and port < 1024 limitations on the SWF applet Socket() class. A
(potentially malicious) server can override the limit with a
cross domain policy file on the server, or it can be overriden
locally at the player with a global setting/policy change, or
by configuring the applet as trusted.

Adobe has a paper on flash security configuration at:

The potential for network misuse possible in Flash just went up
several orders of magnitude, and as the Adobe site triumphantly
proclaims it's apparently in use at 97.3% of networked computers.
I'll avoid some of the more exotic scenarios, lest they give
anyone some bad ideas - and leave this caveat at this warning.

Audited the trusted Flash applets on your system lately?

Forewarned is Forearmed.


World Security Pros. Cutting Edge Training, Tools, and Techniques
Tokyo, Japan November 27-30 2006 http://pacsec.jp
pgpkey http://dragos.com/ kyxpgp

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages