[ISN] 16 months later, Adobe still plagued by XSS bug it invented

http://www.theregister.co.uk/2009/05/14/adobe_xss_bug/

By Dan Goodin in San Francisco
The Register
14th May 2009

More than 16 months after researchers warned that critical 
vulnerabilities in Adobe Flash files leave websites vulnerable to 
phishing and other serious attacks, a wide array of pages - some hosted 
on Adobe.com itself - remain vulnerable.

The problem stems from buggy SWF files that generate banner ads and 
other animated content. In December 2007, a team of researchers 
discovered the files could be exploited by attackers to tamper with 
websites belonging to banks, government agencies and other trusted 
organizations. Over the next few months, the researchers repeatedly 
warned webmasters the problem would be difficult to fix, because it 
would require potentially millions of graphics files to be regenerated, 
often from scratch.

Those warnings now appear to be prescient. As the website XSSed has 
documented, even Adobe.com has failed to contain the offending SWF 
files. Other offenders include the Marfin Egnatia Bank and Greek 
electronics vendor Plaiso.gr. At time of writing, more than 24 hours 
after the XSSed item was published, all three sites remained vulnerable.

"Anyone who includes one of those ads in their site is now susceptible 
to cross-site scripting and some other things," said Jeff Williams, CEO 
of web application security firm Aspect Security who reviewed the 
posting. "It's definitely not good."

[...]


--
LayerOne 2009, Information Security for the discerning professional. 
May 23-24 2009 @ The Anaheim Marriott in Anaheim, California 
Visit http://layerone.info for more information