Adobe Flash Media Server RTMP Memory Corruption Error Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1019398
|
|
SecurityTracker URL: http://securitytracker.com/id?1019398
|
|
CVE Reference: CVE-2007-6148
(Links to External Site)
|
Date: Feb 13 2008
|
Impact: Execution of arbitrary code via network, Root access via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Adobe Advisory
|
Version(s): 2.0.4 and prior versions
|
Description: A vulnerability was reported in Adobe Flash Media Server. A remote user can execute arbitrary code on the target system.
A remote user can send a specially crafted sequence of Real Time Message Protocol (RTMP) messages to the Edge server on TCP port
1935 or 19350 to trigger a memory access error and execute arbitrary code on the target system. The code will run with the privileges
of the target service (System privileges on Windows-based systems).
The vendor was notified on November 27, 2007.
Sean Larsson,
VeriSign iDefense Labs, reported this vulnerability.
|
Impact: A remote user can execute arbitrary code on the target system.
|
Solution: The vendor has issued a fixed version (2.0.5).
The Adobe advisory is available at:
http://www.adobe.com/support/security/bulletins/apsb08-03.html
|
Vendor URL: www.adobe.com/support/security/bulletins/apsb08-03.html (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Red Hat Enterprise), Windows (2000), Windows (2003)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Tue, 12 Feb 2008 22:32:44 -0500
Subject: Update available to address Flash Media Server security issues
|
http://www.adobe.com/support/security/bulletins/apsb08-03.html
CVE-2007-6148
|
|
