||unity-dev|| FYI: Flash Player 9, 0, 115, 0 security hardening can break U2 and other socket server sites!

Discussion list for Unity developers. unity-dev at moock.org
Thu Dec 20 11:21:59 CST 2007


www.adobe.com/devnet/flashplayer/articles/fplayer9_security_04.html (the
whole article is a must-read, but, this is the critical page)

Flash Player 9,0,115,0 introduces new security measures that cause a flash
SWF running in it to "make contact" via PORT 843 during xmlsocket
connections!

This is only the 1st step of what's to come: newer versions will REQUIRE
policy files to be served up DIFFERENTLY (than they were required to, up
until this version) and will cause headaches for us who host/run any socket
server for use with Flash Clients.

This change particularly caused issues with us, as, port 843 (a previously
unused/unknown port) has always been in the realm of ports deemed to be in
violation of firewall rules -- and in our case, by design and "in purpose"
-- forced all clients who attempted such connectivity to have their IP
blocked for a period of time, automatically -- REMEMBER -- this is ONLY for
those clients who have this NEWER version of Flash9 installed and in use AND
IF they call up an swf that tries to make an xmlsocket connection!

So, take note, take heed, this issue is real and coming to all our doorsteps
-- whether we like it or not.

If you're not a developer or host, this affects you in such a way that: At
some point, if not now, you'll not be able to use a site you've been using
without issues alllll along.... until.... you updated your flash player --
UNLESS -- we developers/hosts read-up on the deal and follow the sheep!

Sincerely,

-Jayson K. Hanes
http://flashtampa.com


More information about the unity-dev mailing list