Security Architecture, Endpoint/Device Security, Endpoint/Device Security, Security Strategy, Plan, Budget, Vulnerability Management, Patch/Configuration Management, Endpoint/Device Security, Endpoint/Device Security, Endpoint/Device Security

Adobe patches prevent cross-site scripting attacks via Flash

Adobe on Wednesday released two patches to protect against cross-site scripting (XSS) attacks.

The San Jose, Calif.-based productivity application vendor patched vulnerabilities in Connect Enterprise Server 6, Dreamweaver versions CS3 and 8, and Contribute CS3 and 4 to fix issues that can allow XSS attacks on end-users' PCs.

One flaw, caused by input validation errors in Dreamweaver and Contribute, affects users who have installed the Insert Flash Video command.

Adobe credited Google security researcher Rich Cannings with reporting both flaws, which can be found in Shockwave Flash files on websites.

Cannings told earlier this month that there are hundreds of thousands of vulnerable SWF files on the web.

Cannings and an Adobe representative could not be immediately reached for comment.

Jeremiah Grossman, chief technology officer at WhiteHat Security, told today that XSS is “the No. 1 type of vulnerability out there now.”

“There are many Flash files out there that are vulnerable to this type of attack. There are thousands, and potentially hundreds of thousands of them, and they're all going to have to be rebuilt,” he said. “[The patch] was the vendor-side problem, but they're going to have to wait for the website owners and the website creators to catch up with them.”

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.