[Prev][Next][Index][Thread]

Yet another web-related security vulnerability



This one affects any web browser using the Macromedia Shockwave plugin.
Basically, the plugin correctly filters out "File:" URL requests (which
would allow a Director movie to read a file), but not "Mailbox:" URL
requests.

So, malicious Director movies can read email files if they can guess the
path to the mail files (which is fairly standard on PC's; less so on Macs
since many users rename their hard drives).

I notice that many stories are concentrating on Navigator; some aren't even
mentioning that Explorer and others are also vulnerable...


"Newly Found Security Hole Allows Attackers to Read E-mail and Files"
http://www.nytimes.com:80/library/cyber/week/031597shockwave.html

"Shockwave + Navigator = Vulnerable Email" TechWire
http://www.techweb.com:80/wire/news/mar/0314shockwave.html

"Macromedia Scurries to Plug Security Hole" Web Review
http://webreview.com:80/97/03/14/design/shocking.html

Regards,
Chris




References: