We're experimenting with new ideas and technologies to see what sticks. Check out what we've cooked up and let us know what you think!
Visit LabsStop by our library of training resources and learn something new! Inside you'll find videos, tutorials, guides, and more to help you improve your use of TechSmith tools. You'll be a pro in no time!
Start LearningSearch
Cross-site Scripting in Flash SWF Files
Date Issued: April 15th, 2008
Affected Software and Components: Camtasia Studio v1, v2, v3, v4, and v5 Flash content, except ExpressShow SWF content, the default in v5, which does not accept external input variables. Camtasia Studio v5.1 resolves this issue and is not affected by the vulnerability.
Vulnerability Description: If Flash content (for example, SWF files) is created by the above affected software and is embedded in a website, then the website hosting the Flash content may be vulnerable to cross-site scripting attacks. An attacker can submit malicious data to the vulnerable Flash content in order to perform a cross-site scripting attack: when the vulenerable Flash content is viewed by a website visitor, the visitor's Flash player may take insecure, potentially harmful actions. These actions include modification of website content or sending website information such as cookies to the attacker.
Workarounds or Mitigations: Customers concerned about creating secure Flash content should upgrade to Camtasia Studio v5.1. Customers concerned about viewing Flash content can upgrade their Flash player. Adobe reports that they have addressed the vulnerability with an update to Flash Player (v9.0.115.0), as explained at the following link: Adobe Security Bulletin
Additional Information: No other TechSmith products or services are affected by this vulnerability. SWF files created by the TechSmith Jing application are not affected by this vulnerability, since there is no user-controlled input passed to the SWF file. All Camtasia Studio SWF files hosted by TechSmith's Screencast.com media hosting site, created using any version of Camtasia Studio with any production options, are not affected by this vulnerability. Input parameters passed to the SWF files hosted on Screencast.com are provided by the Screencast.com service, which mitigates this vulnerability. All other TechSmith products do not produce or use SWF files.
Acknowledgements: TechSmith would like to thank Rich Cannings of the Google Security Team for reporting this issue to us.
Corporation, All Rights Reserved.
