Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Adobe Flash Player integer overflow vulnerability
Informations
Name VU#159523 First vendor Publication 2008-04-25
Vendor VU-CERT Last vendor Modification 2008-05-29
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#159523

Adobe Flash Player integer overflow vulnerability

Overview

Adobe Flash contains an integer overflow vulnerability. This vulnerability may allow an attacker to execute code on an affected system.

I. Description

The Adobe Flash Player is a player for the Flash media format and enables frame-based animations and multimedia to be viewed within a web browser.

Adobe Flash Player contains an integer overflow vulnerability. An attacker may be able to trigger this overflow by convincing a user to open a specially crafted SWF file. The SWF file could be hosted or imbedded in a web page.

II. Impact

A remote, unauthenticated attacker may be able to execute arbitrary code or cause the Flash player to crash.

III. Solution

Upgrade


Adobe has released Flash version 9.0.124.0 to address this issue.

Limit access to Flash files

Limiting access to untrusted Flash files may block some attack vectors that use malformed Flash files. See Securing Your Web Browser for more information. Consider using the NoScript extension to whitelist web sites that can run Flash in Mozilla browsers such as Firefox. See the NoScript FAQ for more information.

Systems Affected

VendorStatusDate Updated
AdobeVulnerable25-Apr-2008

References


http://www.adobe.com/support/security/bulletins/apsb08-11.html
http://noscript.net/
http://www.us-cert.gov/reading_room/securing_browser/
http://www.matasano.com/log/1032/this-new-vulnerability-dowds-inhuman-flash-exploit/
http://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pdf
https://www.securecoding.cert.org/confluence/display/seccode/MEM32-C.+Detect+and+handle+memory+allocation+errors
https://www.securecoding.cert.org/confluence/display/seccode/INT02-A.+Understand+integer+conversion+rules

Credit

Thanks to Adobe for information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

Date Public04/08/2008
Date First Published04/25/2008 12:47:22 PM
Date Last Updated05/29/2008
CERT Advisory 
CVE NameCVE-2007-0071
US-CERT Technical Alerts 
Metric38.81
Document Revision22

Original Source

Url : http://www.kb.cert.org/vuls/id/159523

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-189 Numeric Errors (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10379
 
Oval ID: oval:org.mitre.oval:def:10379
Title: Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow.
Description: Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow.
Family: windows Class: vulnerability
Reference(s): CVE-2007-0071
 Version: 5
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows 7
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
Microsoft Windows 8
Microsoft Windows Server 2012
 Product(s): Adobe Flash Player
Adobe AIR
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 72

OpenVAS Exploits

Date Description
2010-05-12 Name : Mac OS X 10.5.3 Update / Mac OS X Security Update 2008-003
File : nvt/macosx_upd_10_5_3_secupd_2008-003.nasl
2009-11-17 Name : Mac OS X Version
File : nvt/macosx_version.nasl
2009-01-23 Name : SuSE Update for flash-player SUSE-SA:2008:022
File : nvt/gb_suse_2008_022.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200804-21 (netscape-flash)
File : nvt/glsa_200804_21.nasl
2008-09-04 Name : FreeBSD Ports: linux-flashplugin
File : nvt/freebsd_linux-flashplugin3.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
44282 Adobe Flash Player Unspecified Input Validation Arbitrary Code Execution

Snort® IPS/IDS

Date Description
2014-01-10 Adobe Flash Player multimedia file DefineSceneAndFrameLabelData code executio...
RuleID : 28637 - Revision : 6 - Type : FILE-FLASH
2014-01-10 Adobe Flash Player multimedia file DefineSceneAndFrameLabelData code executio...
RuleID : 28636 - Revision : 6 - Type : FILE-FLASH
2014-01-10 Adobe Flash Player DefineSceneAndFrameLabelData memory corruption attempt
RuleID : 17647 - Revision : 8 - Type : FILE-FLASH
2014-01-10 Adobe Flash Player SWF scene and label data memory corruption attempt
RuleID : 13822 - Revision : 10 - Type : FILE-FLASH
2014-01-10 Adobe Flash Player SWF scene and label data memory corruption attempt
RuleID : 13821 - Revision : 10 - Type : FILE-FLASH
2014-01-10 Adobe Flash Player SWF scene and label data memory corruption attempt
RuleID : 13820 - Revision : 13 - Type : FILE-FLASH

Nessus® Vulnerability Scanner

Date Description
2009-08-24 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2008-0221.nasl - Type : ACT_GATHER_INFO
2008-06-02 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_04c6187d2d8f11dd98c900163e000016.nasl - Type : ACT_GATHER_INFO
2008-05-29 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_10_5_3.nasl - Type : ACT_GATHER_INFO
2008-05-29 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2008-003.nasl - Type : ACT_GATHER_INFO
2008-04-22 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200804-21.nasl - Type : ACT_GATHER_INFO
2008-04-17 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_flash-player-5159.nasl - Type : ACT_GATHER_INFO
2008-04-17 Name : The remote openSUSE host is missing a security update.
File : suse_flash-player-5161.nasl - Type : ACT_GATHER_INFO
2008-04-10 Name : The remote Windows host contains a browser plugin that is affected by multipl...
File : flash_player_apsb08-11.nasl - Type : ACT_GATHER_INFO