Macromedia Flash Malformed Header Buffer Overflow Vulnerability

Bugtraq ID:	5430
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 08 2002 12:00AM
Updated:	Aug 08 2002 12:00AM
Credit:	Discovery of this issue is credited to eEye Digital Security.
Vulnerable:	Sun Linux 5.0.6 Redhat netscape-navigator-4.79-1.i386.rpm + Redhat Linux 7.3 i386 Redhat netscape-navigator-4.78-2.i386.rpm + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 Redhat netscape-navigator-4.76-11.i386.rpm + Redhat Linux 7.1 i386 Redhat netscape-communicator-4.79-1.i386.rpm + Redhat Linux 7.3 i386 Redhat netscape-communicator-4.78-2.i386.rpm + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 Redhat netscape-communicator-4.76-11.i386.rpm + Redhat Linux 7.1 i386 Redhat netscape-common-4.79-1.i386.rpm + Redhat Linux 7.3 i386 Redhat netscape-common-4.78-2.i386.rpm + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 Redhat netscape-common-4.76-11.i386.rpm + Redhat Linux 7.1 i386 Macromedia Flash 6.0.29 .0 Macromedia Flash 6.0 + Microsoft Internet Explorer 5.0.1 SP2 + Microsoft Internet Explorer 5.0.1 SP2 + Microsoft Internet Explorer 5.0.1 SP1 + Microsoft Internet Explorer 5.0.1 SP1 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 6.0 + Microsoft Internet Explorer 6.0 + Microsoft Internet Explorer 5.5 SP2 + Microsoft Internet Explorer 5.5 SP2 + Microsoft Internet Explorer 5.5 SP1 + Microsoft Internet Explorer 5.5 SP1 + Microsoft Internet Explorer 5.5 preview + Microsoft Internet Explorer 5.5 preview + Microsoft Internet Explorer 5.5 + Microsoft Internet Explorer 5.5 + Microsoft Internet Explorer 5.0 + Microsoft Internet Explorer 5.0 + Microsoft Windows XP Embedded SP3 + Microsoft Windows XP Embedded SP2 + Microsoft Windows XP Home SP3 + Microsoft Windows XP Home SP2 + Microsoft Windows XP Media Center Edition SP3 + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Professional SP3 + Microsoft Windows XP Professional SP2 + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Tablet PC Edition SP3 + Microsoft Windows XP Tablet PC Edition SP2 + Netscape Communicator 6.1 + Netscape Communicator 6.1 + Netscape Communicator 4.78 + Netscape Communicator 4.78 + Netscape Communicator 4.77 + Netscape Communicator 4.77 + Netscape Communicator 4.76 + Netscape Communicator 4.76 + Netscape Communicator 4.75 + Netscape Communicator 4.75 + Netscape Communicator 4.74 + Netscape Communicator 4.74 + Netscape Communicator 4.73 + Netscape Communicator 4.73 + Netscape Communicator 4.72 + Netscape Communicator 4.72 + Netscape Communicator 4.61 + Netscape Communicator 4.61 + Netscape Communicator 4.51 + Netscape Communicator 4.51 + Netscape Communicator 4.7 + Netscape Communicator 4.7 + Netscape Communicator 4.6 + Netscape Communicator 4.6 + Redhat netscape-common-4.76-11.i386.rpm + Redhat netscape-common-4.78-2.i386.rpm + Redhat netscape-common-4.79-1.i386.rpm + Redhat netscape-communicator-4.76-11.i386.rpm + Redhat netscape-communicator-4.78-2.i386.rpm + Redhat netscape-communicator-4.79-1.i386.rpm + Redhat netscape-navigator-4.76-11.i386.rpm + Redhat netscape-navigator-4.78-2.i386.rpm + Redhat netscape-navigator-4.79-1.i386.rpm Macromedia Flash 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional
Not Vulnerable:	Macromedia Flash 6.0.47 .0 Macromedia Flash 6.0.40 .0

Macromedia Flash Malformed Header Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Macromedia Flash Malformed Header Buffer Overflow Vulnerability

References:

• [Full-Disclosure] EEYE: Macromedia Shockwave Flash Malformed Header Overflow (Marc Maiffret)
  
• Macromedia Flash Player Download Center (Macromedia)
  
• MPSB02-09 - Macromedia Flash Malformed Header Vulnerability Issue (Macromedia)
  
• Sun Linux Support - Sun Linux Patches (Sun)