Menu
Adobe patches important flaw in LiveCycle Data Services

Adobe patches important flaw in LiveCycle Data Services

The vulnerability could be exploited to extract sensitive information from servers

Adobe Systems released a security patch for LiveCycle Data Services, a development tool used by businesses to synchronize data between back-end servers and rich Internet applications built with Adobe Flex or AIR.

The hotfix is available for LiveCycle Data Services 3.0.0, 4.5.1, 4.6.2 and 4.7.0 and addresses a vulnerability that could lead to information disclosure.

The flaw is tracked as CVE-2015-3269 in the Common Vulnerabilities and Exposures database and is rated important by Adobe.

The issue is associated with parsing crafted XML entities and falls into a class of vulnerabilities known as XML External Entity (XXE).

According to OWASP, a non-profit organization that produces guidelines for preventing Web flaws, XXE vulnerabilities occur when an application parses XML input that contains a reference to an external entity.

The attack can be used to read sensitive files from a server, scan internal ports, access the server's local network and more. The impact depends on the type of extracted data. In some cases, such information could allow a hacker to plan or execute a more sophisticated attack.

Adobe has also published a support article with detailed information on applying the patch to an affected LiveCycle Data Services application. The steps involve replacing a file called flex-messaging-core.jar and turning the allow-xml-external-entity-expansion option to false in the configuration file.


Follow Us

Join the newsletter!

Error: Please check your email address.

Featured

Slideshows

Kiwi channel closes 2017 with After Hours

Kiwi channel closes 2017 with After Hours

The channel in New Zealand came together to celebrate the close of 2017, as the final After Hours played out in front of a bumper Auckland crowd.

Kiwi channel closes 2017 with After Hours
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP honoured leading partners across the channel at the Partner Awards 2017 in New Zealand, recognising excellence across the entire print and personal systems portfolio.

Meet the top performing HP partners in NZ
Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
Show Comments