Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[ GLSA 200804-21 ] Adobe Flash Player: Multiple vulnerabilities
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index News & Announcements
View previous topic :: View next topic  
Author Message
GLSA
Veteran
Veteran


Joined: 12 May 2004
Posts: 1571

PostPosted: Fri Apr 18, 2008 3:26 pm    Post subject: [ GLSA 200804-21 ] Adobe Flash Player: Multiple vulnerabilit Reply with quote

Gentoo Linux Security Advisory

Title: Adobe Flash Player: Multiple vulnerabilities (GLSA 200804-21)
Severity: normal
Exploitable: remote
Date: April 18, 2008
Updated: May 28, 2009
Bug(s): #204344
ID: 200804-21

Synopsis

Multiple vulnerabilities have been identified, the worst of which allow arbitrary code execution on a user's system via a malicious Flash file.

Background

The Adobe Flash Player is a renderer for the popular SWF file format, which is commonly used to provide interactive websites, digital experiences and mobile content.

Affected Packages

Package: www-plugins/adobe-flash
Vulnerable: < 9.0.124.0
Unaffected: >= 9.0.124.0
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in Adobe Flash:
  • Secunia Research and Zero Day Initiative reported a boundary error related to DeclareFunction2 Actionscript tags in SWF files (CVE-2007-6019).
  • The ISS X-Force and the Zero Day Initiative reported an unspecified input validation error that might lead to a buffer overflow (CVE-2007-0071).
  • Microsoft, UBsecure and JPCERT/CC reported that cross-domain policy files are not checked before sending HTTP headers to another domain (CVE-2008-1654) and that it does not sufficiently restrict the interpretation and usage of cross-domain policy files (CVE-2007-6243).
  • The Stanford University and Ernst and Young's Advanced Security Center reported that Flash does not pin DNS hostnames to a single IP addresses, allowing for DNS rebinding attacks (CVE-2007-5275, CVE-2008-1655).
  • The Google Security Team and Minded Security Multiple reported multiple cross-site scripting vulnerabilities when passing input to Flash functions (CVE-2007-6637).


Impact

A remote attacker could entice a user to open a specially crafted file (usually in a web browser), possibly leading to the execution of arbitrary code with the privileges of the user running the Adobe Flash Player. The attacker could also cause a user's machine to send HTTP requests to other hosts, establish TCP sessions with arbitrary hosts, bypass the security sandbox model, or conduct Cross-Site Scripting and Cross-Site Request Forgery attacks.

Workaround

There is no known workaround at this time.

Resolution

All Adobe Flash Player users should upgrade to the latest version:
Code:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-plugins/adobe-flash-9.0.124.0"


References

CVE-2007-0071
CVE-2007-5275
CVE-2007-6019
CVE-2007-6243
CVE-2007-6637
CVE-2008-1654
CVE-2008-1655


Last edited by GLSA on Fri May 29, 2009 4:18 am; edited 1 time in total
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index News & Announcements All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum