REVISED: MPSB03-05 Patch and Work Around for Dreamweaver MX, DRK, and UltraDev Server Behaviors

From: Jennifer Taylor (jetaylor_at_macromedia.com)
Date: 08/20/03

  • Next message: Drew Copley: "RE: Popular Net anonymity service back-doored" 
    Date: 20 Aug 2003 15:14:45 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is) In-Reply-To: <20030819205018.12485.qmail@www.securityfocus.com>

    Updated with correct URLs to further documentation in the message:

    Summary
    Recently, Macromedia became aware of a security issue with some of the
    server behaviors present in Dreamweaver MX, all versions of UltraDev, and
    two extensions that shipped as part of the Developer’s Resource Kit
    (DRK), vol. 2 and vol. 4. If exploited, it is possible for an attacker to
    gain access to certain site-specific cookie and session information.

    Solution
    Macromedia has issued downloadable patches for Dreamweaver MX and the
    effected Developers Resource Kit Extensions. These fixes will be
    incorporated into all future releases of Dreamweaver. After updating your
    product, you will need to reapply the server behaviors to the pages that
    use them, and redeploy those pages to your server. To download the
    patches for Dreamweaver MX and the effected Developers Resource Kit
    Extensions, please visit TechNote 18838
    (http://www.macromedia.com/support/dreamweaver/ts/documents/security_updat
    e_0803.htm).

    For information on how to resolve this issue in UltraDev please visit
    TechNote 18839
    (http://www.macromedia.com/support/ultradev/ts/documents/security_update_0
    803.htm).

    For concerns or questions regarding this specific security bulletin,
    please email: DWMPSB0305@macromedia.com.

    Severity Rating
    Macromedia categorizes this issue as an important update and recommends
    that users update their product with the respective patch.

    Issue
    Macromedia has learned that the behavior issues, present in Dreamweaver
    MX, all versions of UltraDev, and two extensions included as part of the
    DRK vol. 2 and vol. 4, contain a flaw that if exploited may allow an
    attacker to gain access to certain site-specific cookie and session
    information. This situation arises because the server behavior uses a
    redirect based on a variable, but the variable is not URL encoded. This
    allows an attacker to write script which may ultimately be executed on a
    user's browser.

    Since the script is still subject to normal browser security, this
    vulnerability does not allow arbitrary access to the data on the users’
    machine, nor allow arbitrary code to run. Further, this does not allow
    access to information on the server, nor does it allow any code to be
    executed on the server.

    For a list of behaviors affected in Dreamweaver/DRK Server Behaviors,
    please visit TechNote 18838
    (http://www.macromedia.com/support/dreamweaver/ts/documents/security_updat
    e_0803.htm).

    For a list of behaviors affected in UltraDev, please visit TechNote 18839
    (http://www.macromedia.com/support/ultradev/ts/documents/security_update_0
    803.htm).

    Revisions
    Bulletin first released on August 19, 2003.

    Reporting Security Issues
    Macromedia is committed to addressing security issues and providing
    customers with the information on how they can protect themselves. If you
    identify what you believe may be a security issue with a Macromedia
    product, please send an email to secure@macromedia.com. We will work to
    appropriately address and communicate the issue.

    Receiving Security Bulletins
    When Macromedia becomes aware of a security issue that we believe
    significantly affects our products or customers, we will notify customers
    when appropriate. Typically this notification will be in the form of a
    security bulletin explaining the issue and the response. Macromedia
    customers who would like to receive notification of new security
    bulletins when they are released can sign up for our security
    notification service.

    For additional information on security issues at Macromedia, please visit
    the Security Zone at:
    http://www.macromedia.com/security.

    ANY INFORMATION, PATCHES, DOWNLOADS, WORKAROUNDS OR FIXES PROVIDED BY
    MACROMEDIA IN THIS BULLETIN ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
    KIND. MACROMEDIA AND ITS SUPPLIERS DISCLAIM ALL WARRANTIES, WHETHER
    EXPRESS OR IMPLIED OR OTHERWISE, INCLUDING THE WARRANTIES OF
    MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. ALSO, THERE IS NO
    WARRANTY OF NON-INFRINGEMENT, TITLE OR QUIET ENJOYMENT. (USA ONLY) SOME
    STATES DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO THE ABOVE
    EXCLUSION MAY NOT APPLY TO YOU.

    IN NO EVENT SHALL MACROMEDIA, INC. OR ITS SUPPLIERS BE LIABLE FOR ANY
    DAMAGES WHATSOEVER INCLUDING, WITHOUT LIMITATION, DIRECT, INDIRECT,
    INCIDENTAL, CONSEQUENTIAL, SPECIAL, PUNITIVE, COVER, LOSS OF PROFITS,
    BUSINESS INTERRUPTION OR THE LIKE, OR LOSS OF BUSINESS DAMAGES, BASED ON
    ANY THEORY OF LIABILITY INCLUDING BREACH OF CONTRACT, BREACH OF WARRANTY,
    TORT(INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR OTHERWISE, EVEN IF
    MACROMEDIA, INC. OR ITS SUPPLIERS OR THEIR REPRESENTATIVES HAVE BEEN
    ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. (USA ONLY) SOME STATES DO NOT
    ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR
    INCIDENTAL DAMAGES, SO THE ABOVE EXCLUSION OR LIMITATION MAY NOT APPLY TO
    YOU AND YOU MAY ALSO HAVE OTHER LEGAL RIGHTS THAT VARY FROM STATE TO
    STATE.

    Macromedia reserves the right, from time to time, to update the
    information in this document with current information.

  • Next message: Drew Copley: "RE: Popular Net anonymity service back-doored"

    Relevant Pages