[layingback]

Report

Source

Opinions?

[Dizfunkshunal]

Dont use flash for interactive content!!!!!!!!!!!!! EX: Forums, login scripts, download/upload scripts etc. Been saying that for years.

[DJ Maze]

This issue is so normal.
If a website allows me to upload javascript, the issue is still the same.
Read cookie and forward cookie to malicious domain, voila!

[layingback]

True.

But are the content-type header checks enough to protect against an overloaded GIF, jpg, pdf, zip carrying a flash - or other - payload?

[DJ Maze]

No, but i figured out another way.
Encrypt login cookie with IP address. If IP doesn't match cookie can't be decrypted and login fails.

[layingback]

That seems brilliant! Like most great ideas, seems obvious - after you see it

How big a change though?

I think that only stops a 3rd party domain messing with the webserver. Good to do. But user's Windoze system still vulnerable from the 3rd party site - but what's new? And it looks as if Abode Flash 10 prevents most of the latter by implementing an exact match domain name check.

Unfortunate no clear indication if Adobe's exact domain name match treats a sub-domain as a match or mismatch. If mismatch then I was thinking simply moving coppermine album, etc., to a sub-domain such as uploads.{your_domainname} would prevent that attack vector.