Adobe Flash Player Active Template Library Remote Code Execution Vulnerability
BID:35846
Info
Adobe Flash Player Active Template Library Remote Code Execution Vulnerability
| Bugtraq ID: | 35846 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 28 2009 12:00AM |
| Updated: | Oct 15 2009 08:18PM |
| Credit: | Vendor |
| Vulnerable: |
SuSE SUSE Linux Enterprise Desktop 11 SuSE SUSE Linux Enterprise Desktop 10 SP2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 S.u.S.E. Novell Linux Desktop 9 Pardus Linux 2009 0 Pardus Linux 2008 0 Avaya Interactive Response 4.0 Avaya Interactive Response 3.0 Adobe Flash Player 10.0.22 .87 Adobe Flash Player 10.0.15 .3 Adobe Flash Player 10.0.12 .36 Adobe Flash Player 10.0.12 .35 Adobe Flash Player 9.0.152 .0 Adobe Flash Player 9.0.151 .0 Adobe Flash Player 9.0.124 .0 Adobe Flash Player 9.0.48.0 Adobe Flash Player 9.0.47.0 Adobe Flash Player 9.0.45.0 Adobe Flash Player 9.0.31.0 Adobe Flash Player 9.0.28.0 Adobe Flash Player 9.0.159.0 Adobe Flash Player 9.0.115.0 Adobe Flash Player 9 Adobe Flash Player 10 |
| Not Vulnerable: |
Adobe Flash Player 10.0.32 18 Adobe Flash Player 9.0.246 0 |
Discussion
Adobe Flash Player Active Template Library Remote Code Execution Vulnerability
Adobe Flash Player is prone to a remote code-execution vulnerability because it was compiled against the Microsoft Active Template Library (ATL).
Remote attackers can exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will likely result in a denial-of-service condition.
This issue is caused by the vulnerabilities described in Microsoft security advisory 973883 and is related to the following BIDs:
35828 Microsoft Visual Studio Active Template Library COM Object Remote Code Execution Vulnerability
35830 Microsoft Visual Studio Active Template Library NULL String Information Disclosure Vulnerability
35832 Microsoft Visual Studio ATL 'VariantClear()' Remote Code Execution Vulnerability
Adobe Flash Player is prone to a remote code-execution vulnerability because it was compiled against the Microsoft Active Template Library (ATL).
Remote attackers can exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will likely result in a denial-of-service condition.
This issue is caused by the vulnerabilities described in Microsoft security advisory 973883 and is related to the following BIDs:
35828 Microsoft Visual Studio Active Template Library COM Object Remote Code Execution Vulnerability
35830 Microsoft Visual Studio Active Template Library NULL String Information Disclosure Vulnerability
35832 Microsoft Visual Studio ATL 'VariantClear()' Remote Code Execution Vulnerability
Exploit / POC
Adobe Flash Player Active Template Library Remote Code Execution Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Adobe Flash Player Active Template Library Remote Code Execution Vulnerability
Solution:
Vendor updates are available. Please see the referenced advisory for details.
S.u.S.E. openSUSE 11.0
S.u.S.E. openSUSE 11.1
Solution:
Vendor updates are available. Please see the referenced advisory for details.
S.u.S.E. openSUSE 11.0
-
S.u.S.E. flash-player-9.0.246.0-0.1.i586.rpm
http://download.opensuse.org/update/11.0/rpm/i586/flash-player-9.0.246 .0-0.1.i586.rpm
S.u.S.E. openSUSE 11.1
-
S.u.S.E. flash-player-10.0.32.18-0.1.1.i586.rpm
http://download.opensuse.org/update/11.1/rpm/i586/flash-player-10.0.32 .18-0.1.1.i586.rpm
References
Adobe Flash Player Active Template Library Remote Code Execution Vulnerability
References:
References:
- Impact of Microsoft ATL vulnerability on Adobe Products (Adobe)
- APSA09-04 Security advisory for Adobe Flash Player (Adobe)
- APSB09-10 Security updates available for Adobe Flash Player (Adobe)
- ASA-2009-414 Multiple Security Vulnerabilities in the Flash Player for Solaris 1 (Avaya)
- Microsoft Security Advisory (973882): Vulnerabilities in Microsoft Active Templa (Microsoft)
- Microsoft Security Bulletin MS09-034 (Microsoft)
- Microsoft Security Bulletin MS09-035 (Microsoft)