Adobe Flash Player: Multiple vulnerabilities
1.
Gentoo Linux Security Advisory
Version Information
| Advisory Reference |
GLSA 200801-07 / netscape-flash |
| Release Date |
January 20, 2008 |
| Latest Revision |
January 20, 2008: 02 |
| Impact |
normal |
| Exploitable |
remote |
| Package |
Vulnerable versions |
Unaffected versions |
Architecture(s) |
| net-www/netscape-flash |
<
9.0.115.0 |
>=
9.0.115.0 |
All supported architectures
|
Related bugreports:
#193519
Synopsis
Multiple vulnerabilities have been identified, the worst of which allow
arbitrary code execution on a user's system via a malicious Flash file.
2.
Impact Information
Background
The Adobe Flash Player is a renderer for the popular SWF file format,
which is commonly used to provide interactive websites, digital
experiences and mobile content.
Description
- Flash contains a copy of PCRE which is vulnerable to a heap-based
buffer overflow (GLSA 200711-30, CVE-2007-4768).
- Aaron Portnoy reported an unspecified vulnerability related to
input validation (CVE-2007-6242).
- Jesse Michael and Thomas Biege reported that Flash does not
correctly set memory permissions (CVE-2007-6246).
- Dan Boneh, Adam Barth, Andrew Bortz, Collin Jackson, and Weidong
Shao reported that Flash does not pin DNS hostnames to a single IP
addresses, allowing for DNS rebinding attacks (CVE-2007-5275).
- David Neu reported an error withing the implementation of the
Socket and XMLSocket ActionScript 3 classes (CVE-2007-4324).
- Toshiharu Sugiyama reported that Flash does not sufficiently
restrict the interpretation and usage of cross-domain policy files,
allowing for easier cross-site scripting attacks (CVE-2007-6243).
- Rich Cannings reported a cross-site scripting vulnerability in the
way the "asfunction:" protocol was handled (CVE-2007-6244).
- Toshiharu Sugiyama discovered that Flash allows remote attackers to
modify HTTP headers for client requests and conduct HTTP Request
Splitting attacks (CVE-2007-6245).
Impact
A remote attacker could entice a user to open a specially crafted file
(usually in a web browser), possibly leading to the execution of
arbitrary code with the privileges of the user running the Adobe Flash
Player. The attacker could also cause a user's machine to establish TCP
sessions with arbitrary hosts, bypass the Security Sandbox Model,
obtain sensitive information, port scan arbitrary hosts, or conduct
cross-site-scripting attacks.
3.
Resolution Information
Workaround
There is no known workaround at this time.
Resolution
All Adobe Flash Player users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-www/netscape-flash-9.0.115.0"
|
Please be advised that unaffected packages of the Adobe Flash Player
have known problems when used from within the Konqueror and Opera
browsers.
4.
References
|
