Adobe Flash Media Server NULL Pointer Dereference Remote Denial of Service Vulnerability

Bugtraq ID:	49103
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2011-2132
Remote:	Yes
Local:	No
Published:	Aug 09 2011 12:00AM
Updated:	Oct 12 2011 07:20PM
Credit:	Knud Erik Højgaard of nsense.
Vulnerable:	Adobe Flash Media Server 3.5.4 Adobe Flash Media Server 3.5.3 Adobe Flash Media Server 3.5.2 Adobe Flash Media Server 3.5.1 Adobe Flash Media Server 4.0.2 Adobe Flash Media Server 4.0.1 Adobe Flash Media Server 4.0 Adobe Flash Media Server 3.5.6 Adobe Flash Media Server 3.5.5 Adobe Flash Media Server 3.5
Not Vulnerable:	Adobe Flash Media Server 4.0.3 Adobe Flash Media Server 3.5.7

Adobe Flash Media Server NULL Pointer Dereference Remote Denial of Service Vulnerability

The Adobe Flash Media Server is prone to a remote denial-of-service vulnerability.

Successful exploits will allow attackers to crash the affected application, denying service to legitimate users. Due to the nature of this issue, arbitrary code execution may be possible; however, this has not been confirmed.

Adobe Flash Media Server NULL Pointer Dereference Remote Denial of Service Vulnerability

The following example URI is available:

http://www.example.com:1111/?%

Adobe Flash Media Server NULL Pointer Dereference Remote Denial of Service Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.

Adobe Flash Media Server NULL Pointer Dereference Remote Denial of Service Vulnerability

References:

• Flash Media Server Homepage (Adobe)
  
• nSense Vulnerability Research Security Advisory NSENSE-2011-003 (nSense)
  
• Security update available for Adobe Flash Media Server (Adobe)