Adobe Flash Player Remote Command Execution Vulnerability

Bugtraq ID:	32896
Class:	Input Validation Error
CVE:	CVE-2008-5499
Remote:	Yes
Local:	No
Published:	Dec 17 2008 12:00AM
Updated:	Apr 20 2012 08:10AM
Credit:	This issue was disclosed by Adobe.
Vulnerable:	Turbolinux wizpy 0 Turbolinux FUJI 0 Turbolinux Client 2008 SuSE SUSE Linux Enterprise Desktop 10 SP2 SuSE openSUSE 10.3 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. Novell Linux Desktop 9.0 RedHat Enterprise Linux WS Extras 4 RedHat Enterprise Linux WS Extras 3 RedHat Enterprise Linux Extras 4 RedHat Enterprise Linux Extras 3 RedHat Enterprise Linux ES Extras 4 RedHat Enterprise Linux ES Extras 3 RedHat Enterprise Linux AS Extras 4 RedHat Enterprise Linux AS Extras 3 RedHat Desktop Extras 4 RedHat Desktop Extras 3 Red Hat Enterprise Linux Supplementary 5 server Red Hat Enterprise Linux Desktop Supplementary 5 client Pardus Linux 2008 0 Pardus Linux 2007 0 Gentoo Linux Adobe Flash Player 10.0.12 .36 Adobe Flash Player 10.0.12 .35 Adobe Flash Player 9.0.151 .0 Adobe Flash Player 9.0.124 .0 Adobe Flash Player 9.0.48.0 Adobe Flash Player 9.0.47.0 Adobe Flash Player 9.0.45.0 Adobe Flash Player 9.0.31.0 Adobe Flash Player 9.0.28.0 Adobe Flash Player 9.0.115.0 Adobe Flash Player 9 Adobe Flash Player 8.0.35.0 Adobe Flash Player 8.0.34.0 Adobe Flash Player 7.0.70.0 Adobe Flash Player 7.0.69.0 Adobe Flash Player 7 Adobe Flash Player 10
Not Vulnerable:	Adobe Flash Player 10.0.15 .3 Adobe Flash Player 9.0.152 .0

Adobe Flash Player Remote Command Execution Vulnerability

Adobe Flash Player is prone to a remote command-execution vulnerability due to a failure to validate user supplied input to an internal function.

Remote attackers may exploit this vulnerability to compromise an affected computer.

This issue affects Flash Player on Linux platforms.

Versions prior to Flash Player 10.0.15.3 and 9.0.152.0 are vulnerable.

Adobe Flash Player Remote Command Execution Vulnerability

Immunity has released the following exploit to members of the Immunity Partners program:

https://www.immunityinc.com/downloads/immpartners/launch.as

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploits are available:

• /data/vulnerabilities/exploits/32896.as
• /data/vulnerabilities/exploits/32896.rb

Adobe Flash Player Remote Command Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.


S.u.S.E. openSUSE 11.1

• S.u.S.E. flash-player-10.0.15.3-1.1.i586.rpm
  http://download.opensuse.org/pub/opensuse/update/11.1/rpm/i586/flash-p layer-10.0.15.3-1.1.i586.rpm

S.u.S.E. openSUSE 11.0

• S.u.S.E. flash-player-9.0.152.0-0.1.i586.rpm
  http://download.opensuse.org/pub/opensuse/update/11.0/rpm/i586/flash-p layer-9.0.152.0-0.1.i586.rpm

Adobe Flash Player Remote Command Execution Vulnerability

References:

• Adobe Flash Homepage (Adobe)
  
• You can only sit down if you are a human being (Bas)
  
• APSB08-24 Security update available for Linux Flash Player 10.0.12.36 and Linux (Adobe)