1158453 - SWF #1072 and #1073 Adobe Flash Player Version SWF does not show OS or browser version

Status: RESOLVED INCOMPLETE

(Firefox Graveyard :: Shumway, defect)

Description

[Chris Peterson [:cpeterson]]

http://swf.codeazur.com.br/#f7231a3266d3eb6fa9c8d9f279bd55eb564a77a8ba743517288d5d30e5c03e88

In the Flash Player:

  Your Flash Player Version: 17.0.0.169
  Your OS: Mac OS 10.10.3 (64-bit)
  Your Browser: Mozilla Firefox

In Shumway, the OS and browser fields are blank:

  Your Flash Player Version: 17.0.0.169
  Your OS:
  Your Browser:

The OS and browser are available from JS, so there is no fingerprinting risk from including them. However, Gecko's (nonstandard) navigator.oscpu returns "Intel Mac OS X 10.10", excluding the ".3" version field, presumably to reduce fingerprinting. Gecko's User-Agent string also omits ".3" also, though Chrome and Safari include it. Shumway should do the same, but perhaps add a dummy ".0" to avoid breaking AS code trying to parse the OS string.

Comment 1

[Chris Peterson [:cpeterson]]

SWF #1073 also shows incorrect versions:

In the Flash Player:

  Your Player Version: MAC 17,0,0,169
  Operating System: Mac OS 10.10.3

In Shumway,

  Your Player Version: Unknown
  Operating System: Mac OS 10.5.2

"10.5.2"?! :)

Comment 2

[Chris Peterson [:cpeterson]]

SWF #1073
http://swf.codeazur.com.br/#53d891b2d8214bb1364fadc6bf8cfc43a10c05412d84bb8d203c7ff0405dce5c

Comment 3

[Chris Peterson [:cpeterson]]

We can defer this bug to shumway-later because the only reason an ad would need to know the user's OS or browser version is to fingerprint them for tracking.