----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
Techsmith Camtasia SWF "csPreloader" Cross-Site Scripting
Vulnerability

SECUNIA ADVISORY ID:
SA28311

VERIFY ADVISORY:
http://secunia.com/advisories/28311/

CRITICAL:
Less critical

IMPACT:
Cross Site Scripting

WHERE:
>From remote

SOFTWARE:
Camtasia Studio 4.x
http://secunia.com/product/13192/
Camtasia Studio 3.x
http://secunia.com/product/7708/
Camtasia Studio 2.x
http://secunia.com/product/8392/

DESCRIPTION:
Rich Cannings has reported a vulnerability in Techsmith Camtasia,
which can be exploited by malicious people to conduct cross-site
scripting attacks.

Input passed to the "csPreloader" parameter in a generated SWF file
is not properly verified before being used. This can be exploited to
load arbitrary flash files from external resources and conduct
cross-site scripting attacks against a web site hosting a vulnerable
SWF file.

SOLUTION:
Upgrade to Camtasia Studio version 5 and regenerate the SWF files.

Contact the vendor for information on how to update SWF files.

PROVIDED AND/OR DISCOVERED BY:
Rich Cannings, Google Security Team.

ORIGINAL ADVISORY:
http://docs.google.com/View?docid=ajfxntc4dmsq_14dt57ssdw

OTHER REFERENCES:
US-CERT VU#249337:
http://www.kb.cert.org/vuls/id/249337

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------