BID:32129

Adobe Flash Player Multiple Security Vulnerabilities

Info

Adobe Flash Player Multiple Security Vulnerabilities

Bugtraq ID:	32129
Class:	Unknown
CVE:	CVE-2008-4818 CVE-2008-4819 CVE-2008-4820 CVE-2008-4821 CVE-2008-4822 CVE-2008-4823 CVE-2008-4824 CVE-2008-5361 CVE-2008-5362 CVE-2008-5363
Remote:	Yes
Local:	No
Published:	Nov 06 2008 12:00AM
Updated:	Mar 10 2009 11:06PM
Credit:	Adam Barth of Standford University, Collin Jackson of Stanford University, Nathan McFeters and Rob Carter of Ernst and Young's Advanced Security Center, Stefano Di Paola of Minded Security, Alex 'kuza55' k., Gregory Fleisher of pseudo-flaw.net, Riley Hasse
Vulnerable:	Sun Solaris 10_x86 Sun Solaris 10_sparc Sun OpenSolaris build snv_96 Sun OpenSolaris build snv_95 Sun OpenSolaris build snv_92 Sun OpenSolaris build snv_91 Sun OpenSolaris build snv_90 Sun OpenSolaris build snv_89 Sun OpenSolaris build snv_88 Sun OpenSolaris build snv_87 Sun OpenSolaris build snv_85 Sun OpenSolaris build snv_103 Sun OpenSolaris build snv_102 Sun OpenSolaris build snv_101 Sun OpenSolaris build snv_100 Redhat Enterprise Linux Supplementary 5 server Redhat Enterprise Linux Extras 4 Redhat Enterprise Linux Extras 3 Redhat Enterprise Linux Desktop Supplementary 5 client Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service - CCSS7 0 Gentoo Linux Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.4.11 Apple Mac OS X 10.5 Adobe Flex 3.0 Adobe Flash Player 9.0.124 .0 Adobe Flash Player 9.0.48.0 Adobe Flash Player 9.0.47.0 Adobe Flash Player 9.0.45.0 Adobe Flash Player 9.0.31.0 Adobe Flash Player 9.0.28.0 Adobe Flash Player 9.0.115.0 Adobe Flash Player 9 Adobe Flash Player 8.0.35.0 Adobe Flash Player 8.0.34.0 Adobe Flash Player 7.0.70.0 Adobe Flash Player 7.0.69.0 Adobe Flash Player 7 Adobe Flash Player 10 Adobe Flash CS4 Professional 0 Adobe AIR 1.1

Not Vulnerable:	Sun OpenSolaris build snv_104 Apple Mac OS X Server 10.5.6 Apple Mac OS X 10.5.6 Adobe Flash Player 10.0.12 .36 Adobe Flash Player 9.0.151 .0 Adobe AIR 1.5

Discussion

Adobe Flash Player Multiple Security Vulnerabilities

Adobe Flash Player is prone to multiple security vulnerabilities.

Attackers can exploit these issues to obtain sensitive information, steal cookie-based authentication credentials, control how webpages are rendered, execute arbitrary script code in the context of the application, and execute arbitrary code in the context of the application. Other attacks may also be possible.

These issues affect Flash Player 9.0.124.0 and prior versions.

Exploit / POC

Adobe Flash Player Multiple Security Vulnerabilities

An attacker can exploit some of these issues by enticing an unsuspecting victim to follow a malicious URI or to open a malicious SWF or JAR file.

Solution / Fix

Adobe Flash Player Multiple Security Vulnerabilities

Solution:
The vendor has released an advisory and updates. Please see the references for more information.

Adobe Flash Player 10