Other nomination

More Port Scanning - This Time in Flash

David Neu and fukami

CVE-2007-4324. ActionScript 3 raises SecurityErrorEvent immediately for a closed TCP port but waits for a reply to its policy-file request on an open one, so the two-second delay reveals port state. A SWF scans any reachable host without DNS rebinding, one player instance per port. Fixed in Flash Player 10.

Record

Researcher

David Neu and fukami

In the archive

• Nominated for the 2007 Top 10 Web Hacking Techniques

Tags

• flash
• timing-attack
• side-channel
• sandbox-escape
• cve
• info-leak

This page is the archive's own catalogue record. The research is the work of David Neu and fukami, first published at the original source. Preserved copies are kept so the citation survives its host.