Macromedia Flash Array Index Memory Access Vulnerability

Bugtraq ID:	15332
Class:	Input Validation Error
CVE:	CVE-2005-2628
Remote:	Yes
Local:	No
Published:	Nov 05 2005 12:00AM
Updated:	Nov 20 2006 07:55PM
Credit:	Discovered by Fang Xing of eEye.
Vulnerable:	S.u.S.E. Linux Professional 9.1 x86_64 S.u.S.E. Linux Professional 9.1 S.u.S.E. Linux Professional 9.0 x86_64 S.u.S.E. Linux Professional 9.0 S.u.S.E. Linux Personal 9.1 x86_64 S.u.S.E. Linux Personal 9.1 S.u.S.E. Linux Personal 9.0 x86_64 S.u.S.E. Linux Personal 9.0 Netscape Browser 8.0.4 Netscape Browser 8.0.3 .3 Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Tablet PC Edition SP1 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP2 Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition Version 2003 SP1 Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows XP 0 Microsoft Windows ME Microsoft Windows 98SE Microsoft Windows 98 Macromedia Flash 7.0.19 .0 Macromedia Flash 7.0 r19 Macromedia Flash 6.0.79 .0 Macromedia Flash 6.0.65 .0 Macromedia Flash 6.0.47 .0 Macromedia Flash 6.0.40 .0 Macromedia Flash 6.0.29 .0 Macromedia Flash 6.0 + Microsoft Internet Explorer 5.0.1 SP2 + Microsoft Internet Explorer 5.0.1 SP2 + Microsoft Internet Explorer 5.0.1 SP1 + Microsoft Internet Explorer 5.0.1 SP1 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 6.0 + Microsoft Internet Explorer 6.0 + Microsoft Internet Explorer 5.5 SP2 + Microsoft Internet Explorer 5.5 SP2 + Microsoft Internet Explorer 5.5 SP1 + Microsoft Internet Explorer 5.5 SP1 + Microsoft Internet Explorer 5.5 preview + Microsoft Internet Explorer 5.5 preview + Microsoft Internet Explorer 5.5 + Microsoft Internet Explorer 5.5 + Microsoft Internet Explorer 5.0 + Microsoft Internet Explorer 5.0 + Microsoft Windows XP Embedded SP3 + Microsoft Windows XP Embedded SP2 + Microsoft Windows XP Home SP3 + Microsoft Windows XP Home SP2 + Microsoft Windows XP Media Center Edition SP3 + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Professional SP3 + Microsoft Windows XP Professional SP2 + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Tablet PC Edition SP3 + Microsoft Windows XP Tablet PC Edition SP2 + Netscape Communicator 6.1 + Netscape Communicator 6.1 + Netscape Communicator 4.78 + Netscape Communicator 4.78 + Netscape Communicator 4.77 + Netscape Communicator 4.77 + Netscape Communicator 4.76 + Netscape Communicator 4.76 + Netscape Communicator 4.75 + Netscape Communicator 4.75 + Netscape Communicator 4.74 + Netscape Communicator 4.74 + Netscape Communicator 4.73 + Netscape Communicator 4.73 + Netscape Communicator 4.72 + Netscape Communicator 4.72 + Netscape Communicator 4.61 + Netscape Communicator 4.61 + Netscape Communicator 4.51 + Netscape Communicator 4.51 + Netscape Communicator 4.7 + Netscape Communicator 4.7 + Netscape Communicator 4.6 + Netscape Communicator 4.6 + Redhat netscape-common-4.76-11.i386.rpm + Redhat netscape-common-4.78-2.i386.rpm + Redhat netscape-common-4.79-1.i386.rpm + Redhat netscape-communicator-4.76-11.i386.rpm + Redhat netscape-communicator-4.78-2.i386.rpm + Redhat netscape-communicator-4.79-1.i386.rpm + Redhat netscape-navigator-4.76-11.i386.rpm + Redhat netscape-navigator-4.78-2.i386.rpm + Redhat netscape-navigator-4.79-1.i386.rpm Gentoo Linux
Not Vulnerable:	Netscape Browser 8.1 Macromedia Flash 8.0.22 .0 Macromedia Flash 7.0.61 .0 Macromedia Flash 7.0.60 .0

Macromedia Flash Array Index Memory Access Vulnerability

The Flash plug-in is vulnerable to an input-validation error that can be reliably exploited to execute arbitrary code. The vulnerability is due to an input-validation error for a critical array index value.

An attacker can exploit this vulnerability to execute arbitrary code. The most likely vector of attack is through a malicious SWF file designed to trigger the vulnerability that has been placed on a website.

Macromedia Flash 6 and 7 are reported affected.

Macromedia Flash Array Index Memory Access Vulnerability

eEye claims to have developed reliable exploit code.

Macromedia Flash Array Index Memory Access Vulnerability

Solution:
The vendor has released an update to address this issue.

Please see the referenced vendor advisories for details on obtaining and applying the appropriate updates.

NOTE: Reportedly, Netscape Browser version 8.1 based on Gecko code base (User-agent: Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20060111 Netscape/8.1) ships with Flash Player 8 version 8.0.22.0, which is not vulnerable to this issue.


Microsoft Windows XP Media Center Edition SP2

• Microsoft Security Update for Flash Player (KB913433)
  downloads

Microsoft Windows XP Tablet PC Edition SP1

• Microsoft Security Update for Flash Player (KB913433)
  downloads

Microsoft Windows XP Home SP2

• Microsoft Security Update for Flash Player (KB913433)
  downloads

Microsoft Windows XP Tablet PC Edition SP2

• Microsoft Security Update for Flash Player (KB913433)
  downloads

Microsoft Windows XP Media Center Edition SP1

• Microsoft Security Update for Flash Player (KB913433)
  downloads

Microsoft Windows XP Home SP1

• Microsoft Security Update for Flash Player (KB913433)
  downloads

Microsoft Windows XP Professional SP2

• Microsoft Security Update for Flash Player (KB913433)
  downloads

Microsoft Windows XP Professional SP1

• Microsoft Security Update for Flash Player (KB913433)
  downloads

Macromedia Flash Array Index Memory Access Vulnerability

References:

• Microsoft Security Advisory (910550) (Microsoft)
  
• Microsoft Security Advisory: Macromedia Security Bulletin MPSB05-07: "Flash Play (Microsoft)
  
• Microsoft Security Bulletin MS06-020 - Vulnerabilities in Macromedia Flash Playe (Microsoft)
  
• MPSB05-07 Flash Player 7 Improper Memory Access Vulnerability (Macromedia)
  
• Netscape Homepage (Netscape)