Why allow flash footers?

[kamyab]

Why does this community allow flash footers? Isn't there a potential exploit, allowing users to hijack accounts and steal passwords?

[senocular]

A while ago, yes. It has since been 'corrected' - its effects can be avoided by the html code used to embed the swf.

[mlk]

Isn't there a potential exploit, allowing users to hijack accounts and steal passwords?

hehe we are a peaceful community - who would ever think of hacking into our little Kirupaville ?
Besides Flash Footers Rock - get one :beam: !

[mlk]

whaddya mean you lock your files ???

[mlk]

Senocular, what you said is not true. The issue has not been corrected.

[senocular]

I read somewhere it can be prevented with the html embed

[kamyab]

Not here, apparently

[ahmed]

unless you dont have any recent flash player installed, everything should be fine..

[mlk]

I (kamyab) am able to sign into mlk's account, so something is deffinately wrong.

[Jubba]

how did you do that?

[ahmed]

ooops

jubba - http://eyeonsecurity.net/papers/flash-xss.htm :)

[mlk]

I will let you know in a PM
[edit]
ahmed, thats it. Well, almost.

[senocular]

Maybe what Im thinking of is something completely different

[ahmed]

well that's odd. Over at another forum we have contacted macromedia about this security hole back in july.. they said they "have this issue resolved and will be releasing a player very shortly (but within the month of July) as we announced previous." By now i think everyone would've upgraded they're player.. :-\

[kamyab]

I think senocular was talking about this
http://www.macromedia.com/support/flash/ts/documents/allow_script_access.htm

AllowScriptAccess can prevent a SWF file hosted from one domain from accessing a script in an HTML page that comes from another domain. Using AllowScriptAccess="never" for all SWF files hosted from another domain can ensure security of scripts located in an HTML page.
What if both the swf and script are on the same domain?