CERT-In Vulnerability Note
CIVN-2007-0162
Adobe Flash Player Cross-Site Scripting Vulnerability
Original Issue Date:December 26, 2007
Severity Rating: HIGH
Systems Affected
- Adobe Flash Player 9.0.48.0 and earlier
- Adobe Flash Player 8.0.35.0 and earlier
- Adobe Flash Player 7.0.70.0 and earlier
Overview
Multiple vulnerabilities exist in various Adobe products, which could be exploited by malicious user locally or remotely to cause executio n of arbitrary code, disclosure of sensitive information, Denial of Service, co nduct cross site scripting attacks and bypass certain security restrictions.
Description
Multiple vulnerabilities exist in Adobe products due to input validation errors while handling the .swf files, PCRE Perl Compatible Regular Expressions , "allow-access-from" elements, cross-domain policy files , "asfunction:" protocol , "navigateToURL" function files ,
HTTP headers of client requests , Action Script 3 socket , memory permissions in the Flash Player. These Vulnerabilities could be exploited by the remote attacker to execute arbitrary code via specially crafted Flash Files hosting on the web site and persuade user to open the same. Successful exploitation would allow remote attacker to cause execution of arbitrary code, the disclosure of sensitive information, denial-of-service conditions, conduct cross site scripting attacks and bypass certain security restrictions. Specific inputs of these Vulnerabilities vary depending upon the conditions required for exploitation.
Solution
Apply patches as mentioned in ADOBE Advisory:
http://www.adobe.com/support/security/bulletins/apsb07-20.html
Vendor Information
Adobe
http://www.adobe.com/products/flashplayer/
References
FrSIRT
http://www.frsirt.com/english/advisories/2007/4258
US-CERT
http://www.us-cert.gov/cas/techalerts/TA07-355A.html
CVE Name
CVE-2007-6242
CVE-2007-4768
CVE-2007-5275
CVE-2007-6243
CVE-2007-6244
CVE-2007-6245
CVE-2007-4324
CVE-2007-6246
CVE-2007-5476
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|