Vulnerability Note VU#395473

Adobe Flash player code execution vulnerability

Overview

Adobe Flash contains a vulnerability that may allow an attacker to run code on a system that has a vulnerable version of the Flash player installed. There are reports that this vulnerability is being actively exploited.

I. Description

The Adobe Flash Player is a player for the Flash media format and enables frame-based animations and multimedia to be viewed within a web browser.

Adobe Flash Player contains a code execution vulnerability. An attacker may be able to trigger this overflow by convincing a user to open a specially crafted SWF file. The SWF file could be hosted or embedded in a web page. If an attacker can take control of a website or web server, trusted sites may exploit this vulnerability.

II. Impact

A remoted, unauthenticated attacker may be able to execute arbitrary code.

III. Solution

Update

This issue has been addressed in the most recent version (9.0.124.0) of Adobe Flash. Microsoft Windows users should browse to the Adobe Flash Player Support Center downloads and install the most recent version of Flash site using Internet Explorer, then repeat the process for all other installed browsers (Firefox, Opera, Safari, etc). Systems that are not running Windows should be updated by going to the Adobe Flash Player Support Center downloads and installing the most recent version of Flash with all each web browser on the system.

Users who rely their operating system vendor to provide a packaged version of Adobe Flash should confirm that they have the most recent version.

Workarounds for users running Mozilla-based browsers

• Using the Mozilla Firefox NoScript extension to whitelist websites that can run scripts and access installed plugins may prevent this vulnerability from being exploited. Note that NoScript is not likely to stop all attack vectors for this vulnerability, see the NoScript FAQ for more information.
• On Linux systems, the Flash player can be disabled by renaming the Flash plugin. The plugin may be found in several locations, including /usr/lib/firefox/plugins/usr/lib/iceweael/plugins/usr/lib/mozilla/plugins, and is named flashplugin-alternative.so
• Firefox 3 users can disable the Flash plugin by going to tools, Add-ons, then clicking the Disable button next to the Shockwave Flash plugin. Note that this setting only applies to Mozilla Firefox, and other browsers such as Mozilla, Konqueror, Opera, and Epiphany will still be able to access the Flash plugin.

Workarounds for users running Internet Explorer

• Applying the kill bit for the following CLSID will prevent the Flash plugin from running:
  {D27CDB6E-AE6D-11cf-96B8-444553540000}
  More information about how to set the kill bit is available in Microsoft Support Document 240797.
  

Workarounds for web server administrators

• Ensure that security updates are applied to software running on the server.
• Reverse proxy servers and web application firewalls may be able to detect and block some attacks. Administrators may also use iptables string matching to block or whitelist the Flash MIME type (application/x-shockwave-flash). Note that firewalls and IPS systems are not likely to stop all attacks.
• Administrators and web developers should confirm that third parties (such as ad providers) hosting content on their domains are not acting as attack vectors for this vulnerability.

Workarounds for network administrators

• Firewall, web proxies and IPS systems may be able to stop some attacks. Iptables string matching or the Squid req_mime_type ACL can be used to block access by restricting which sites can send the Flash MIME type (application/x-shockwave-flash). For example, the below iptables command will log all packets that contain the string x-shockwave-flash. Note that this filter can be circumvented by using IPS evasion techniques.
  iptables -A INPUT -m string --algo bm --string 'x-shockwave-flash' -j LOG --log-prefix FLASH

Systems Affected

Vendor	Status	Date Updated
Adobe	Vulnerable	27-May-2008

References

http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash
http://isc.sans.org/diary.html?storyid=4465
http://blogs.adobe.com/psirt/2008/05/potential_flash_player_issue.html
http://www.kb.cert.org/vuls/id/159523
http://www.securityfocus.com/bid/29386
http://noscript.net/
http://www.stopbadware.org/home/security
http://www.owasp.org/index.php/Web_Application_Firewall
http://ddanchev.blogspot.com/2008/05/malware-attack-exploiting-flash-zero.html
http://www.symantec.com/security_response/threatcon/index.jsp
http://www.netfilter.org/documentation/HOWTO//netfilter-extensions-HOWTO-3.html#ss3.18
http://www.visolve.com/squid/squid24s1/access_controls.php
http://kb.adobe.com/selfservice/viewContent.do?externalId=tn_4151

Credit

Thanks to SANS for information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

Date Public	05/27/2008
Date First Published	05/27/2008 06:20:57 PM
Date Last Updated	05/28/2008
CERT Advisory
CVE Name
US-CERT Technical Alerts
Metric	65.81
Document Revision	36