Adobe Flash Player SWF code execution
| flashplayer-swf-code-execution (35337) |  High Risk |
Description:
Adobe Macromedia Flash Player could allow a remote attacker to execute arbitrary code on the system, caused by an unspecified vulnerability. By persuading a victim to view a specially-crafted SWF file, a remote attacker could exploit this vulnerability to execute arbitrary code on the system.
Platforms Affected:
- Adobe, Flash Player 9
- Adobe, Flash Player 9.0.124.0
- Adobe, Flash Player 9.0.16
- Adobe, Flash Player 9.0.18d60
- Adobe, Flash Player 9.0.20
- Adobe, Flash Player 9.0.20.0
- Adobe, Flash Player 9.0.28
- Adobe, Flash Player 9.0.28.0
- Adobe, Flash Player 9.0.31
- Adobe, Flash Player 9.0.31.0
- Adobe, Flash Player 9.0.45.0
- Apple, Mac OS X 10.4
- Apple, Mac OS X 10.4.1
- Apple, Mac OS X 10.4.10
- Apple, Mac OS X 10.4.2
- Apple, Mac OS X 10.4.3
- Apple, Mac OS X 10.4.4
- Apple, Mac OS X 10.4.5
- Apple, Mac OS X 10.4.6
- Apple, Mac OS X 10.4.7
- Apple, Mac OS X 10.4.8
- Apple, Mac OS X 10.4.9
- Apple, Mac OS X Server 10.4
- Apple, Mac OS X Server 10.4.1
- Apple, Mac OS X Server 10.4.10
- Apple, Mac OS X Server 10.4.2
- Apple, Mac OS X Server 10.4.3
- Apple, Mac OS X Server 10.4.4
- Apple, Mac OS X Server 10.4.5
- Apple, Mac OS X Server 10.4.6
- Apple, Mac OS X Server 10.4.7
- Apple, Mac OS X Server 10.4.8
- Apple, Mac OS X Server 10.4.9
- Gentoo, Linux
- Novell, Linux Desktop 9
- Novell, OpenSUSE 10.2
- Novell, SUSE Linux Enterprise Desktop 10 SP1
- Novell, UnitedLinux 1.0
- RedHat, RHEL Desktop Supplementary 5 Client
- RedHat, RHEL Extras 3
- RedHat, RHEL Extras 4
- RedHat, RHEL Supplementary 5 Server
- Sun, Solaris 10 SPARC
- Sun, Solaris 10 x86
- SuSE, SuSE Linux 9.0
- SuSE, SuSE Linux Enterprise Server 8.0
- SuSE, SuSE Linux Retail Solution 8
- Turbolinux, Turbolinux FUJI
- Turbolinux, Turbolinux wizpy
Remedy:
Refer to APSB07-12 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Apply the appropriate update for your system. See References.
Consequences:
Gain Access
References:
- Apple Web site, About the security content of Mac OS X 10.4.11 and Security Update 2007-008 at http://docs.info.apple.com/article.html?artnum=307041.
- APSB07-12, Flash Player update available to address security vulnerabilities at http://www.adobe.com/support/security/bulletins/apsb07-12.html.
- Minded Security Labs: Advisory #MSA01110707, Flash Player/Plugin Video file parsing Remote Code Execution at http://www.mindedsecurity.com/en/labs/advisories/MSA01110707.
- Sun Alert ID: 103167, Security Vulnerabilities in Adobe Flash Player May Allow Unauthorized System Access or Generation of HTTP Requests at http://sunsolve.sun.com/search/document.do?assetkey=1-26-103167-1.
- ASA-2007-362: flash-plugin security update (RHSA-2007-0696)
- ASA-2007-530: Security Vulnerabilities in Adobe Flash Player May Allow Unauthorized System Access or Generation of HTTP Requests (Sun 103167)
- BID-24856: Adobe Flash Player SWF File Handling Remote Code Execution Vulnerability
- BID-26444: Apple Mac OS X v10.4.11 2007-008 Multiple Security Vulnerabilities
- CVE-2007-3456: Integer overflow in Adobe Flash Player 9.0.45.0 and earlier might allow remote attackers to execute arbitrary code via a large length value for a (1) Long string or (2) XML variable type in a crafted (a) FLV or (b) SWF file, related to an input validation error
- FrSIRT/ADV-2007-2497: Adobe Flash Player Multiple Code Execution and Security Bypass Vulnerabilities
- FrSIRT/ADV-2007-3868: Apple Mac OS X Command Execution and Denial of Service Vulnerabilities
- FrSIRT/ADV-2007-4190: Sun Solaris Security Update Fixes Flash Player Multiple Vulnerabilities
- GLSA-200708-01: Macromedia Flash Player: Remote arbitrary code execution
- RHSA-2007-0696: Critical: flash-plugin security update
- SA26027: Adobe Flash Player Multiple Vulnerabilities
- SA27643: Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
- SECTRACK ID: 1018359: Adobe Flash Player Bugs Let Remote Users Execute Arbitrary Code or Conduct Cross-Site Request Forgery Attacks
- SUSE-SA:2007:046: flash-player security problems
Reported:
Jul 10, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net