9.3 - RHSA-2008:0221

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	flash-plugin security update

Informations
Name	RHSA-2008:0221	First vendor Publication	2008-04-08
Vendor	RedHat	Last vendor Modification	2008-04-08
Severity (Vendor)	Critical	Revision	01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

An updated Adobe Flash Player package that fixes several security issues is now available for Red Hat Enterprise Linux 3 Extras, Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 Extras - i386 Red Hat Desktop version 3 Extras - i386 Red Hat Enterprise Linux ES version 3 Extras - i386 Red Hat Enterprise Linux WS version 3 Extras - i386 Red Hat Enterprise Linux AS version 4 Extras - i386 Red Hat Desktop version 4 Extras - i386 Red Hat Enterprise Linux ES version 4 Extras - i386 Red Hat Enterprise Linux WS version 4 Extras - i386 RHEL Desktop Supplementary (v. 5 client) - i386, x86_64 RHEL Supplementary (v. 5 server) - i386, x86_64

3. Description:

The flash-plugin package contains a Firefox-compatible Adobe Flash Player Web browser plug-in.

Several input validation flaws were found in the way Flash Player displayed certain content. These may have made it possible to execute arbitrary code on a victim's machine, if the victim opened a malicious Adobe Flash file. (CVE-2007-0071, CVE-2007-6019)

A flaw was found in the way Flash Player established TCP sessions to remote hosts. A remote attacker could, consequently, use Flash Player to conduct a DNS rebinding attack. (CVE-2007-5275, CVE-2008-1655)

A flaw was found in the way Flash Player restricted the interpretation and usage of cross-domain policy files. A remote attacker could use Flash Player to conduct cross-domain and cross-site scripting attacks. (CVE-2007-6243, CVE-2008-1654)

A flaw was found in the way Flash Player interacted with web browsers. An attacker could use malicious content presented by Flash Player to conduct a cross-site scripting attack. (CVE-2007-6637)

All users of Adobe Flash Player should upgrade to this updated package, which contains Flash Player version 9.0.124.0 and resolves these issues.

4. Solution:

Before applying this update, make sure that all previously-released errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188

5. Bugs fixed (http://bugzilla.redhat.com/):

367501 - CVE-2007-5275 Flash plugin DNS rebinding 440664 - CVE-2007-6243 Flash Player cross-domain and cross-site scripting flaws 440666 - CVE-2007-6637 Flash Player content injection flaw

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2008-0221.html

CWE : Common Weakness Enumeration

%	Id	Name
33 %	CWE-79	Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)
17 %	CWE-352	Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25)
17 %	CWE-264	Permissions, Privileges, and Access Controls
17 %	CWE-189	Numeric Errors (CWE/SANS Top 25)
17 %	CWE-20	Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10160

Oval ID:	oval:org.mitre.oval:def:10160
Title:	Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via an SWF file with a modified DeclareFunction2 Actionscript tag, which prevents an object from being instantiated properly.
Description:	Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via an SWF file with a modified DeclareFunction2 Actionscript tag, which prevents an object from being instantiated properly.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2007-6019	Version:	5
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows 8.1 Microsoft Windows Server 2012 R2 Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Adobe Flash Player Adobe AIR
Definition Synopsis:
Flash.ocx section ActiveX Control is installed AND Flash.ocx vulnerable version Determine if the version of Flash.ocx is less than or equal 9.0.124.0 OR Vulnerable version of Adobe Flash Player Adobe Flash Player is installed AND Adobe Flash Player version is less than or equal 9.0.124.0 OR Adobe Vulnerable version of Adobe AIR Adobe AIR is installed AND Check if the version of Adobe Air is less than 1.0.1

Definition Id: oval:org.mitre.oval:def:10379

Oval ID:	oval:org.mitre.oval:def:10379
Title:	Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow.
Description:	Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2007-0071	Version:	5
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows 8.1 Microsoft Windows Server 2012 R2 Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Adobe Flash Player Adobe AIR
Definition Synopsis:
Flash.ocx section ActiveX Control is installed AND Flash.ocx vulnerable version Determine if the version of Flash.ocx is less than or equal 9.0.124.0 OR Vulnerable version of Adobe Flash Player Adobe Flash Player 9 is installed AND Adobe Flash Player version is less than or equal 9.0.124.0 OR Adobe Vulnerable version of Adobe AIR Adobe AIR is installed AND Check if the version of Adobe Air is less than 1.0.1

Definition Id: oval:org.mitre.oval:def:10724

Oval ID:	oval:org.mitre.oval:def:10724
Title:	Unspecified vulnerability in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, makes it easier for remote attackers to conduct DNS rebinding attacks via unknown vectors.
Description:	Unspecified vulnerability in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, makes it easier for remote attackers to conduct DNS rebinding attacks via unknown vectors.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2008-1655	Version:	5
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows 8.1 Microsoft Windows Server 2012 R2 Microsoft Windows 8 Microsoft Windows Server 2012	Product(s):	Adobe Flash Player Adobe AIR
Definition Synopsis:
Flash.ocx section ActiveX Control is installed AND Flash.ocx vulnerable version Determine if the version of Flash.ocx is less than or equal 9.0.124.0 OR Vulnerable version of Adobe Flash Player Adobe Flash Player 9 is installed AND Adobe Flash Player version is less than or equal 9.0.124.0 OR Adobe Vulnerable version of Adobe AIR Adobe AIR is installed AND Check if the version of Adobe Air is less than 1.0.1

Definition Id: oval:org.mitre.oval:def:11069

Oval ID:	oval:org.mitre.oval:def:11069
Title:	Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 does not sufficiently restrict the interpretation and usage of cross-domain policy files, which makes it easier for remote attackers to conduct cross-domain and cross-site scripting (XSS) attacks.
Description:	Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 does not sufficiently restrict the interpretation and usage of cross-domain policy files, which makes it easier for remote attackers to conduct cross-domain and cross-site scripting (XSS) attacks.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-6243	Version:	3
Platform(s):	Red Hat Enterprise Linux Extras 3 Red Hat Enterprise Linux Extras 4 Red Hat Enterprise Linux Extras 5	Product(s):
Definition Synopsis:
IF redhat-release is version 3 AND flash-plugin is earlier than 0:9.0.124.0-1.el3.with.oss OR redhat-release is version 4 AND flash-plugin is earlier than 0:9.0.124.0-1.el4 OR redhat-release is version 5 AND flash-plugin is earlier than 0:9.0.124.0-1.el5

Definition Id: oval:org.mitre.oval:def:11435

Oval ID:	oval:org.mitre.oval:def:11435
Title:	Interaction error between Adobe Flash and multiple Universal Plug and Play (UPnP) services allow remote attackers to perform Cross-Site Request Forgery (CSRF) style attacks by using the Flash navigateToURL function to send a SOAP message to a UPnP control point, as demonstrated by changing the primary DNS server.
Description:	Interaction error between Adobe Flash and multiple Universal Plug and Play (UPnP) services allow remote attackers to perform Cross-Site Request Forgery (CSRF) style attacks by using the Flash navigateToURL function to send a SOAP message to a UPnP control point, as demonstrated by changing the primary DNS server.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2008-1654	Version:	5
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 R2 Microsoft Windows Server 2012	Product(s):	Adobe Flash Player Adobe AIR
Definition Synopsis:
Flash.ocx section ActiveX Control is installed AND Flash.ocx vulnerable version Determine if the version of Flash.ocx is less than or equal 9.0.124.0 OR Vulnerable version of Adobe Flash Player Adobe Flash Player 9 is installed AND Adobe Flash Player version is less than or equal 9.0.124.0 OR Adobe Vulnerable version of Adobe AIR Adobe AIR is installed AND Check if the version of Adobe Air is less than 1.0.1

Definition Id: oval:org.mitre.oval:def:24682

Oval ID:	oval:org.mitre.oval:def:24682
Title:	Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file
Description:	Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector is already covered by CVE-2007-6244.1.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2007-6637	Version:	8
Platform(s):	Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows 7 Microsoft Windows Server 2008 R2 Microsoft Windows 8 Microsoft Windows Server 2012 Microsoft Windows 8.1 Microsoft Windows Server 2012 R2	Product(s):	Adobe Flash Player
Definition Synopsis:
Adobe Flash Player section Adobe Flash Player 9 is installed AND Adobe Flash Player version is less than or equal 9.0.115.0 OR Flash.ocx section ActiveX Control is installed AND Determine if the version of Flash.ocx is less than or equal 9.0.115.0 AND Determine if the version of Flash.ocx is greater than or equal 9.0

Definition Id: oval:org.mitre.oval:def:24909

Oval ID:	oval:org.mitre.oval:def:24909
Title:	Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 does not sufficiently restrict the interpretation and usage of cross-domain policy files, which makes it easier for remote attackers to conduct cross-domain and cross-site scripting (XSS) attacks.
Description:	Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 does not sufficiently restrict the interpretation and usage of cross-domain policy files, which makes it easier for remote attackers to conduct cross-domain and cross-site scripting (XSS) attacks.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2007-6243	Version:	7
Platform(s):	Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows 7 Microsoft Windows Server 2008 R2 Microsoft Windows 8 Microsoft Windows Server 2012 Microsoft Windows 8.1 Microsoft Windows Server 2012 R2	Product(s):	Adobe Flash Player
Definition Synopsis:
Adobe Flash Player section Adobe Flash Player 9 is installed AND Adobe Flash Player version is less than or equal 9.0.48.0 OR Flash.ocx section ActiveX Control is installed AND Determine if the version of Flash.ocx is less than or equal 9.0.48.0 AND Determine if the version of Flash.ocx is greater than or equal 9.0

Definition Id: oval:org.mitre.oval:def:9250

Oval ID:	oval:org.mitre.oval:def:9250
Title:	The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324.
Description:	The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2007-5275	Version:	5
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows 8 Microsoft Windows Server 2012 Microsoft Windows 8.1 Microsoft Windows Server 2012 R2	Product(s):	Adobe Flash Player Adobe AIR
Definition Synopsis:
Flash.ocx section ActiveX Control is installed AND Flash.ocx vulnerable version Determine if the version of Flash.ocx is less than or equal 9.0.124.0 OR Vulnerable version of Adobe Flash Player Adobe Flash Player 9 is installed AND Adobe Flash Player version is less than or equal 9.0.124.0 OR Adobe Vulnerable version of Adobe AIR Adobe AIR is installed AND Check if the version of Adobe Air is less than 1.0.1

Definition Id: oval:org.mitre.oval:def:9828

Oval ID:	oval:org.mitre.oval:def:9828
Title:	Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector is already covered by CVE-2007-6244.1.
Description:	Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector is already covered by CVE-2007-6244.1.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-6637	Version:	3
Platform(s):	Red Hat Enterprise Linux Extras 3 Red Hat Enterprise Linux Extras 4 Red Hat Enterprise Linux Extras 5	Product(s):
Definition Synopsis:
IF redhat-release is version 3 AND flash-plugin is earlier than 0:9.0.124.0-1.el3.with.oss OR redhat-release is version 4 AND flash-plugin is earlier than 0:9.0.124.0-1.el4 OR redhat-release is version 5 AND flash-plugin is earlier than 0:9.0.124.0-1.el5

CPE : Common Platform Enumeration

Type	Description	Count
Application	Adobe Air cpe:2.3:a:adobe:air:1.0:::::::*	1
Application	Adobe Flash cpe:2.3:a:adobe:flash:professional:8:::::: cpe:2.3:a:adobe:flash:professional:cs3:::::: cpe:2.3:a:adobe:flash:basic:8::::::	3
Application	Adobe Flash Player cpe:2.3:a:adobe:flash_player:9.0.9.0:::::::* cpe:2.3:a:adobe:flash_player:9.0.8.0:::::::* cpe:2.3:a:adobe:flash_player:9.0.48.0:::::::* cpe:2.3:a:adobe:flash_player:9.0.47.0:::::::* cpe:2.3:a:adobe:flash_player:9.0.45.0:::::::* cpe:2.3:a:adobe:flash_player:9.0.31.0:::::::* cpe:2.3:a:adobe:flash_player:9.0.31:::::::* cpe:2.3:a:adobe:flash_player:9.0.28.0:::::::* cpe:2.3:a:adobe:flash_player:9.0.28.0::mac_os_x::::: cpe:2.3:a:adobe:flash_player:9.0.28:::::::* cpe:2.3:a:adobe:flash_player:9.0.20.0:::::::* cpe:2.3:a:adobe:flash_player:9.0.20:::::::* cpe:2.3:a:adobe:flash_player:9.0.18d60:::::::* cpe:2.3:a:adobe:flash_player:9.0.16.0:::::::* cpe:2.3:a:adobe:flash_player:9.0.16:::::::* cpe:2.3:a:adobe:flash_player:9.0.16::windows::::: cpe:2.3:a:adobe:flash_player:9.0.155.0:::::::* cpe:2.3:a:adobe:flash_player:9.0.124.0:::::::* cpe:2.3:a:adobe:flash_player:9.0.115.0:::::::* cpe:2.3:a:adobe:flash_player:9.0.114.0:::::::* cpe:2.3:a:adobe:flash_player:9.0.112.0:::::::* cpe:2.3:a:adobe:flash_player:9.0:::::::* cpe:2.3:a:adobe:flash_player:8.0.42.0:::::::* cpe:2.3:a:adobe:flash_player:8.0.39.0:::::::* cpe:2.3:a:adobe:flash_player:8.0.35.0:::::::* cpe:2.3:a:adobe:flash_player:8.0.34.0:::::::* cpe:2.3:a:adobe:flash_player:8.0.33.0:::::::* cpe:2.3:a:adobe:flash_player:8.0.24.0:::::::* cpe:2.3:a:adobe:flash_player:8.0.22.0:::::::* cpe:2.3:a:adobe:flash_player:8.0::basic::::: cpe:2.3:a:adobe:flash_player:8.0:::::::* cpe:2.3:a:adobe:flash_player:8.0::pro::::: cpe:2.3:a:adobe:flash_player:8::pro::::: cpe:2.3:a:adobe:flash_player:8::professional::::: cpe:2.3:a:adobe:flash_player:7.2:::::::* cpe:2.3:a:adobe:flash_player:7.1.1:::::::* cpe:2.3:a:adobe:flash_player:7.1:::::::* cpe:2.3:a:adobe:flash_player:7.0.73.0:::::::* cpe:2.3:a:adobe:flash_player:7.0.70.0:::::::* cpe:2.3:a:adobe:flash_player:7.0.69.0:::::::* cpe:2.3:a:adobe:flash_player:7.0.68.0:::::::* cpe:2.3:a:adobe:flash_player:7.0.67.0:::::::* cpe:2.3:a:adobe:flash_player:7.0.66.0:::::::* cpe:2.3:a:adobe:flash_player:7.0.63::linux::::: cpe:2.3:a:adobe:flash_player:7.0.63:::::::* cpe:2.3:a:adobe:flash_player:7.0.61.0:::::::* cpe:2.3:a:adobe:flash_player:7.0.60.0:::::::* cpe:2.3:a:adobe:flash_player:7.0.53.0:::::::* cpe:2.3:a:adobe:flash_player:7.0.25:::::::* cpe:2.3:a:adobe:flash_player:7.0.24.0:::::::* cpe:2.3:a:adobe:flash_player:7.0.19.0:::::::* cpe:2.3:a:adobe:flash_player:7.0.14.0:::::::* cpe:2.3:a:adobe:flash_player:7.0.1:::::::* cpe:2.3:a:adobe:flash_player:7.0_r67:::::::* cpe:2.3:a:adobe:flash_player:7.0_r67::solaris::::: cpe:2.3:a:adobe:flash_player:7.0:::::::* cpe:2.3:a:adobe:flash_player:6.0.79:::::::* cpe:2.3:a:adobe:flash_player:6.0.21.0:::::::* cpe:2.3:a:adobe:flash_player:6:::::::* cpe:2.3:a:adobe:flash_player:5:::::::* cpe:2.3:a:adobe:flash_player:4:::::::* cpe:2.3:a:adobe:flash_player:3:::::::* cpe:2.3:a:adobe:flash_player:2:::::::* cpe:2.3:a:adobe:flash_player:mx_2004:::::::* cpe:2.3:a:adobe:flash_player:cs4::pro::::: cpe:2.3:a:adobe:flash_player:cs3::professional::::: cpe:2.3:a:adobe:flash_player:cs3::pro::::: cpe:2.3:a:adobe:flash_player:::::::: cpe:2.3:a:adobe:flash_player::::::edge::* cpe:2.3:a:adobe:flash_player::::::internet_explorer_11::* cpe:2.3:a:adobe:flash_player::::::chrome::* cpe:2.3:a:adobe:flash_player:::pro:::::* cpe:2.3:a:adobe:flash_player:::basic:::::* cpe:2.3:a:adobe:flash_player:-:::::::*	74
Application	Adobe Flex cpe:2.3:a:adobe:flex:3.0:::::::*	1
Application	Adobe Shockwave Player cpe:2.3:a:adobe:shockwave_player:9:::::::*	1

OpenVAS Exploits

Date	Description
2010-05-12	Name : Mac OS X 10.5.3 Update / Mac OS X Security Update 2008-003 File : nvt/macosx_upd_10_5_3_secupd_2008-003.nasl
2009-11-17	Name : Mac OS X Version File : nvt/macosx_version.nasl
2009-01-28	Name : SuSE Update for flash-player SUSE-SA:2007:069 File : nvt/gb_suse_2007_069.nasl
2009-01-23	Name : SuSE Update for flash-player SUSE-SA:2008:022 File : nvt/gb_suse_2008_022.nasl
2008-11-01	Name : FreeBSD Ports: linux-flashplugin File : nvt/freebsd_linux-flashplugin4.nasl
2008-10-16	Name : Adobe Flash Player Multiple Security Bypass Vulnerabilities (Linux) File : nvt/gb_adobe_flash_player_sec_bypass_vuln_lin.nasl
2008-10-16	Name : Adobe Flash Player Multiple Security Bypass Vulnerabilities (Win) File : nvt/gb_adobe_flash_player_sec_bypass_vuln_win.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200801-07 (netscape-flash) File : nvt/glsa_200801_07.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200804-21 (netscape-flash) File : nvt/glsa_200804_21.nasl
2008-09-04	Name : FreeBSD Ports: linux-flashplugin File : nvt/freebsd_linux-flashplugin2.nasl
2008-09-04	Name : FreeBSD Ports: linux-flashplugin File : nvt/freebsd_linux-flashplugin3.nasl
2008-09-03	Name : Adobe Flash Player 9.0.115.0 and earlier vulnerability (Lin) File : nvt/flash_player_CB-A08-0059.nasl
2008-09-03	Name : Adobe Flash Player 9.0.115.0 and earlier vulnerability (Win) File : nvt/smbcl_flash_player_CB-A08-0059.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
51567	Adobe Flash Cross-domain Policy Canonicalization Weakness
44283	Adobe Flash Player Unspecified DNS Rebinding Issue
44282	Adobe Flash Player Unspecified Input Validation Arbitrary Code Execution
44279	Adobe Flash UPnP navigateToURL Function SOAP Message CSRF
43979	Adobe Flash Player DeclareFunction2 Embedded Actionscript Handling Arbitrary ...
41490	Adobe Flash Player Crafted SWF File Multiple Unspecified XSS
41489	Adobe Flash Player SWF DNS Pinning Arbitrary Host TCP Connection
41487	Adobe Flash Player Cross-domain Policy Unspecified Weakness

Information Assurance Vulnerability Management (IAVM)

Date	Description
2008-01-23	IAVM : 2008-B-0011 - Multiple Adobe Dreamweaver CS3 and Adobe Acrobat Connect SWF Cross-Site Scrip... Severity : Category II - VMSKEY : V0015694

Snort® IPS/IDS

Date	Description
2014-01-10	Adobe Flash Player multimedia file DefineSceneAndFrameLabelData code executio... RuleID : 28637 - Revision : 6 - Type : FILE-FLASH
2014-01-10	Adobe Flash Player multimedia file DefineSceneAndFrameLabelData code executio... RuleID : 28636 - Revision : 6 - Type : FILE-FLASH
2014-01-10	Adobe Flash Player DefineSceneAndFrameLabelData memory corruption attempt RuleID : 17647 - Revision : 8 - Type : FILE-FLASH
2014-01-10	Adobe Flash Player SWF scene and label data memory corruption attempt RuleID : 13822 - Revision : 10 - Type : FILE-FLASH
2014-01-10	Adobe Flash Player SWF scene and label data memory corruption attempt RuleID : 13821 - Revision : 10 - Type : FILE-FLASH
2014-01-10	Adobe Flash Player SWF scene and label data memory corruption attempt RuleID : 13820 - Revision : 13 - Type : FILE-FLASH

Nessus® Vulnerability Scanner

Date	Description
2013-01-24	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2008-0980.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2008-0945.nasl - Type : ACT_GATHER_INFO
2009-08-24	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2008-0221.nasl - Type : ACT_GATHER_INFO
2009-08-24	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-1126.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_flash-player-081107.nasl - Type : ACT_GATHER_INFO
2008-11-18	Name : The remote Windows host contains a runtime environment that is affected by mu... File : adobe_air_apsb08-23.nasl - Type : ACT_GATHER_INFO
2008-11-12	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_flash-player-5757.nasl - Type : ACT_GATHER_INFO
2008-11-12	Name : The remote openSUSE host is missing a security update. File : suse_flash-player-5747.nasl - Type : ACT_GATHER_INFO
2008-11-11	Name : The remote Windows host contains a browser plugin that is affected by multipl... File : flash_player_apsb08-20.nasl - Type : ACT_GATHER_INFO
2008-10-20	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_78f456fd9c8711dda55e00163e000016.nasl - Type : ACT_GATHER_INFO
2008-06-02	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_04c6187d2d8f11dd98c900163e000016.nasl - Type : ACT_GATHER_INFO
2008-05-29	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_10_5_3.nasl - Type : ACT_GATHER_INFO
2008-05-29	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-003.nasl - Type : ACT_GATHER_INFO
2008-04-22	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200804-21.nasl - Type : ACT_GATHER_INFO
2008-04-17	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_flash-player-5159.nasl - Type : ACT_GATHER_INFO
2008-04-17	Name : The remote openSUSE host is missing a security update. File : suse_flash-player-5161.nasl - Type : ACT_GATHER_INFO
2008-04-10	Name : The remote Windows host contains a browser plugin that is affected by multipl... File : flash_player_apsb08-11.nasl - Type : ACT_GATHER_INFO
2008-01-21	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200801-07.nasl - Type : ACT_GATHER_INFO
2008-01-04	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_562cf6c4b9f111dca302000102cc8983.nasl - Type : ACT_GATHER_INFO
2007-12-24	Name : The remote openSUSE host is missing a security update. File : suse_flash-player-4855.nasl - Type : ACT_GATHER_INFO
2007-12-24	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_flash-player-4856.nasl - Type : ACT_GATHER_INFO
2007-12-19	Name : The remote Windows host contains a browser plugin that is affected by multipl... File : flash_player_apsb07-20.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:51:34	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	6
Oval ID(s)	9
CPE ID(s)	80
osvdb(s)	8
Openvas Exploit(s)	13
IAVM(s)	1
Snort® Rule(s)	6
Nessus® Exploit(s)	22

	Related
9.3	CVE-2007-6243
9.3	CVE-2007-6019
9.3	CVE-2007-0071
5	CVE-2007-5275
4.3	CVE-2008-1655
4.3	CVE-2008-1654
4.3	CVE-2007-6637
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 7 more Alert(s)