Flash Player Vulnerability

[Wt Riker]

I found a vulnerability in flash player but it was simple enough to resolve myself. However this should be added to the next release. In the javascript file:

.jenkins/war/scripts/yui/connection/connection-min.js

This line:

<param name="allowScriptAccess" value="always">

Needs to be changed to:

<param name="allowScriptAccess" value="sameDomain">

This vulnerability makes it possible to steal or manipulate session cookies which might be used to impersonate a legitimate user.

[Christopher Orr]

Hi there,

Thanks for the info.

Which pages are you seeing on Jenkins where this Javascript file is
used, or where a Flash Player is embedded?

Regards,
Chris

[Wt Riker]

The link is:

http://jenkins.server.com:8080/static/452bd4e7/scripts/yui/connection/connection-min.js

I don't know what page contains that link or how it gets generates. Perhaps you can direct me on how to figure that out.

[Daniel Beck]

On 03.02.2015, at 16:29, Wt Riker <wtrik...@gmail.com> wrote:

> The link is:
>
> http://jenkins.server.com:8080/static/452bd4e7/scripts/yui/connection/connection-min.js

Better readable file:
https://github.com/jenkinsci/jenkins/blob/master/war/src/main/webapp/scripts/yui/connection/connection-debug.js#L1046

It's part of the YUI library and used to enable cross-domain requests.

According to https://helpx.adobe.com/flash-player/kb/changes-allowscriptaccess-default-flash-player.html doing this requires AllowScriptAccess 'always'.

> It protects an HTML file from a potentially untrusted SWF file, by controlling the ability of that SWF file to call JavaScript code in the surrounding HTML file. AllowScriptAccess has three possible values: "always", "sameDomain", and "never".

I'm not a Flash expert, but as the SWF file used here is connection.swf from the same library (YUI) and should be trusted, and any embedding only happens for deliberate cross-domain requests, this doesn't seem to be a real issue.

If you have further information that shows this is an actual problem, please submit a report with further information to the SECURITY project in Jira.

https://wiki.jenkins-ci.org/display/JENKINS/Security+Advisories#SecurityAdvisories-ReportSecurityProblems
https://wiki.jenkins-ci.org/display/JENKINS/How+to+report+an+issue