BID:25260

Adobe ActionScript SecurityErrorEvent Security Bypass Vulnerability

Info

Adobe ActionScript SecurityErrorEvent Security Bypass Vulnerability

Bugtraq ID:	25260
Class:	Design Error
CVE:	CVE-2007-4324
Remote:	Yes
Local:	No
Published:	Aug 09 2007 12:00AM
Updated:	Feb 09 2009 11:48PM
Credit:	David Neu is credited with the discovering this vulnerability. The exploit code was developed by fukami of SektionEins.
Vulnerable:	Turbolinux wizpy 0 Turbolinux FUJI 0 SuSE Suse Linux Enterprise Desktop 10 SP2 SuSE Suse Linux Enterprise Desktop 10 SP1 Sun Solaris 10_x86 Sun Solaris 10_sparc Sun Solaris 10.0_x86 Sun Solaris 10.0 Sun OpenSolaris build snv_96 Sun OpenSolaris build snv_95 Sun OpenSolaris build snv_92 Sun OpenSolaris build snv_91 Sun OpenSolaris build snv_90 Sun OpenSolaris build snv_89 Sun OpenSolaris build snv_88 Sun OpenSolaris build snv_87 Sun OpenSolaris build snv_85 Sun OpenSolaris build snv_103 Sun OpenSolaris build snv_102 Sun OpenSolaris build snv_101 Sun OpenSolaris build snv_100 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Novell Linux Desktop 9 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.1 Redhat Enterprise Linux Supplementary 5 server Redhat Enterprise Linux Extras 4.5.z Redhat Enterprise Linux Extras 4 Redhat Enterprise Linux Extras 3 Redhat Enterprise Linux Desktop Supplementary 5 client Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service - CCSS7 0 Nortel Networks Peri Workstation 0 Nortel Networks Peri Application 0 Nortel Networks Media Processing Svr 1000 Rel 3.0 Gentoo Linux Adobe Flex 2.0 Adobe Flash Player 9.0.124 .0 Adobe Flash Player 9.0.48.0 Adobe Flash Player 9.0.47.0 Adobe Flash Player 9.0.45.0 Adobe Flash Player 9.0.31.0 Adobe Flash Player 9.0.28.0 Adobe Flash Player 9.0.115.0 Adobe Flash Player 9 Adobe Flash Player 8.0.35.0 Adobe Flash Player 8.0.34.0 Adobe Flash Player 7.0.70.0 Adobe Flash Player 7.0.69.0 Adobe Flash Player 7 Adobe Flash CS3 Professional 0 Adobe ActionScript 3

Not Vulnerable:	Sun OpenSolaris build snv_104 Adobe Flash Player 10.0.12 .36

Discussion

Adobe ActionScript SecurityErrorEvent Security Bypass Vulnerability

Adobe ActionScript is prone to a security-bypass vulnerability because the application allows Flash movies compiled by ActionScript to connect to arbitrary TCP ports on a host running a vulnerable version of Flash.

Successfully exploiting this issue allows an attacker to bypass the application's sandbox security model and scan other hosts that are connected to the computer running the vulnerable application.

Exploit / POC

Adobe ActionScript SecurityErrorEvent Security Bypass Vulnerability

An exploit is available at the following site:

http://scan.flashsec.org/

Solution / Fix

Adobe ActionScript SecurityErrorEvent Security Bypass Vulnerability

Solution:
Adobe has released updates to address these issues. Please see the references for more information.

Adobe Flash Player 9.0.31.0