Menu
Flaw in open-source PDF viewer could put WikiLeaks users, others at risk

Flaw in open-source PDF viewer could put WikiLeaks users, others at risk

The flaw could be exploited to launch XSS and content spoofing attacks

An open-source component used to display PDF files on WikiLeaks.org and other websites contains vulnerabilities that could be exploited to launch cross-site scripting (XSS) and content spoofing attacks against visitors.

The vulnerable component is called FlexPaper and is developed by a company called Devaldi, based in New Zealand. The company confirmed the issues, which were first reported Thursday on the WikiLeaks supporters forum, and released FlexPaper 2.3.0 to address them.

However, it seems that the component hasn't yet been updated on WikiLeaks.org, which was still using FlexPaper 2.1.2 on some pages Tuesday.

The incident comes after Wired reported last week that in 2012 the FBI used a Flash-based component to decloak Tor users and find their real IP (Internet Protocol) addresses in an operation that targeted users of child pornography websites hosted on the Tor network.

Since WikiLeaks' audience includes a lot of users that value their privacy and anonymity, any vulnerability in the site that could potentially be used to expose their real location is likely to be viewed as a serious threat.

"Given the fact that most browsers use plugins to enable the reading of PDFs, we strongly urge WikiLeaks to link directly to PDF files instead of using third party software that could put users at risk," said a user named Koyaanisqatsi, who reported the flaws on the WikiLeaks forum.

That's what WikiLeaks did with two secret documents about travelling through airports using false ID that were allegedly leaked from the U.S. Central Intelligence Agency. The site published the documents Sunday and directly linked to the PDF files instead of displaying them in an embedded viewer.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags patchesDevaldisecuritywikileaksExploits / vulnerabilitiesprivacy

Featured

Slideshows

Reseller News launches inaugural Hall of Fame lunch

Reseller News launches inaugural Hall of Fame lunch

Reseller News welcomed 2015 and 2016 inductees - Darryl Swann, Dave Rosenberg, Gary Bigwood, Keith Watson, Mike Hill and Scott Green - to the inaugural Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed how the channel can collectively work together to benefit New Zealand, the Kiwi skills shortage and the future of the industry. Photos by Maria Stefina.

Reseller News launches inaugural Hall of Fame lunch
Educating from the epicentre - Why distributors are the pulse checkers of the channel

Educating from the epicentre - Why distributors are the pulse checkers of the channel

​As the channel changes and industry voices deepen, the need for clarity and insight heightens. Market misconceptions talk of an “under pressure” distribution space, with competitors in that fateful “race for relevance” across New Zealand. Amidst the cliched assumptions however, distribution is once again showing its strength, as a force to be listened to, rather than questioned. Traditionally, the role was born out of a need for vendors and resellers to find one another, acting as a bridge between the testing lab and the marketplace. Yet despite new technologies and business approaches shaking the channel to its very core, distributors remain tied to the epicentre - providing the voice of reason amidst a seismic industry shift. In looking across both sides of the vendor and partner fences, the middle concept of the three-tier chain remains centrally placed to understand the metrics of two differing worlds, as the continual pulse checkers of the local channel. This exclusive Reseller News Roundtable, in association with Dicker Data and rhipe, examined the pivotal role of distribution in understanding the health of the channel, educating from the epicentre as the market transforms at a rapid rate.

Educating from the epicentre - Why distributors are the pulse checkers of the channel
Kiwi channel reunites as After Hours kicks off 2017

Kiwi channel reunites as After Hours kicks off 2017

After Hours made a welcome return to the channel social calendar last night, with a bumper crowd of distributors, vendors and resellers descending on The Jefferson in Auckland to kickstart 2017. Photos by Maria Stefina.

Kiwi channel reunites as After Hours kicks off 2017
Show Comments