(Sun Issues Fix for Solaris) Adobe Flash Player Bugs Let Remote Users Execute Arbitrary Code or Conduct Cross-Site Request Forgery Attacks
|
|
SecurityTracker Alert ID: 1019080
|
|
SecurityTracker URL: http://securitytracker.com/id?1019080
|
|
CVE Reference: CVE-2007-3456
(Links to External Site)
|
Date: Dec 12 2007
|
Impact: Execution of arbitrary code via network, Modification of user information, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Sun Alert
|
Version(s): 9.0.45.0 and prior 9.0 versions, 8.0.34.0 and prior 8.0 versions, and 7.0.69.0 and prior 7.0 versions
|
Description: Two vulnerabilities were reported in Adobe Flash Player. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted SWF file that, when loaded by the target user, will trigger an input validation flaw
and execute arbitrary code on the target system [CVE-2007-3456]. The code will run with the privileges of the target user.
A
remote user can send a specially crafted HTTP Referer value to conduct cross-site request forgery attacks [CVE-2007-3457]. Flash
Player 9 is not affected.
Adobe credits Stefano DiPaola, Elia Florio, and Giorgio Fedon with reporting the input validation vulnerability
and Daiki Fukumori of Secure Sky Technology, Inc. with reporting the HTTP Referer vulnerability.
|
Impact: A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system.
A remote user can conduct cross-site request forgery attacks.
|
Solution: Sun has issued the following fixes to upgrade FlashPlayer to version 9.0 r47.
SPARC Platform
* Solaris 10 with patch 125332-02
or later
x86 Platform
* Solaris 10 with patch 125333-02 or later
The Sun advisory is available at:
http://sunsolve.sun.com/search/document.do?assetkey=1-2
6-103167-1
|
Vendor URL: www.adobe.com/support/security/bulletins/apsb07-12.html (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: UNIX (Solaris - SunOS)
|
Underlying OS Comments: 10
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 11 Dec 2007 21:31:52 -0500
Subject: Security Vulnerabilities in Adobe Flash Player May Allow Unauthorized System Access or Generation of HTTP Requests
|
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103167-1
CVE-2007-2022
CVE-2007-3456
CVE-2007-3457
|
|
