Comment 1 Christopher Guindon 2014-05-12 11:17:05 EDT

This look like an old vulnerability:
http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2008-January/003417.html



We should probably remove all instances of this flash player from our servers and transfer the videos to youtube.


I believe the video player was created by TechSmith:
http://www.techsmith.com/

Comment 2 Denis Roy 2014-05-12 13:49:34 EDT

> We should probably remove all instances of this flash player from our
> servers and transfer the videos to youtube.

Since it involves a bunch of projects, I'd go even further: we simply block the ".swf" extension on www.eclipse.org

Would that cause anything else to blow up?

Comment 3 Christopher Guindon 2014-05-13 09:21:17 EDT

(In reply to Denis Roy from comment #2)
> > We should probably remove all instances of this flash player from our
> > servers and transfer the videos to youtube.
> 
> Since it involves a bunch of projects, I'd go even further: we simply block
> the ".swf" extension on www.eclipse.org
> 
> Would that cause anything else to blow up?

+1 I think it's a good idea for us to stop supporting Flash. We should probably do a quick search to see what exactly we are going to break.

Comment 4 Edouard Poitras 2014-05-13 10:25:45 EDT

(In reply to Denis Roy from comment #2)
> Since it involves a bunch of projects, I'd go even further: we simply block
> the ".swf" extension on www.eclipse.org

+1

Comment 5 Denis Roy 2014-05-13 13:51:34 EDT

> find . -type f -name '*.swf' | sort | sed -e 's/^.\///' | awk -F/ '{print $1 "/" $2}' | uniq -c


     14 ajdt/demos
      1 articles/Article-Accessibility351
      3 articles/Article-Authoring-With-Eclipse
     12 atf/demos
      6 atf/flash
      1 atl/usecases
      1 atl/videos
      5 bpmn2-modeler/videos
      1 cdt/movies
      2 eclipse.org-common/yui
      5 eef/videos
     14 emf/compare
     15 epsilon/cinema
      2 equinox/documents
      2 europa/images
      2 gmt/modisco
      1 gyrex/screencasts
     14 intent/pages
      4 jubula/script
      6 jwt/press
      2 modeling/emf
      5 modeling/emft
     12 modeling/gmp
      3 modeling/mdt
      8 modeling/presentations
      8 mylyn/doc
      1 nebula/widgets
     28 org/june05release
      1 org/press-release
      1 papyrus/updates
      2 papyrus/videos
      1 projects/dev_process
      1 recommenders/assets
      3 sapphire/samples
      5 swt/e4
     34 tptp/home
      4 tptp/performance
      1 tptp/platform
      3 tptp/test
      1 webtools/community
      8 webtools/dali
      3 webtools/phoenix

Comment 6 Wayne Beaton 2014-05-13 14:02:14 EDT

FWIW, the "copy to clipboard" functionality provided by Gerrit uses SWF.

Comment 7 Denis Roy 2014-05-13 16:34:21 EDT

I'd like to pretend that active projects that include third-party tools ship up-to-date versions that are not vulnerable.  Maybe that is naïve.

I'm planning on including a short communiqué about this to committers tomorrow.

Comment 8 Denis Roy 2014-05-15 15:04:48 EDT

I've added the restriction to www.eclipse.org

I'll also add it to download.eclipse.org and archive.eclipse.org and I think we'll be done.

Comment 9 Denis Roy 2014-05-15 15:12:09 EDT

> I'll also add it to download.eclipse.org and archive.eclipse.org and I think
> we'll be done.

Done and done.  Closing.  Thanks for the report.