Secunia Security Advisory - Some security issues have been reported in Adobe Flash Player, which can be exploited by malicious people to bypass certain security restrictions or manipulate certain data.
59afea582d05178a367dadb6b85a630e98d43e4f04c492ec0adc140fc41c8046
----------------------------------------------------------------------
Do you need accurate and reliable IDS / IPS / AV detection rules?
Get in-depth vulnerability details:
http://secunia.com/binary_analysis/sample_analysis/
----------------------------------------------------------------------
TITLE:
Adobe Flash Player Multiple Security Issues
SECUNIA ADVISORY ID:
SA32270
VERIFY ADVISORY:
http://secunia.com/advisories/32270/
CRITICAL:
Less critical
IMPACT:
Security Bypass, Manipulation of data
WHERE:
>From remote
SOFTWARE:
Adobe Flash Player 9.x
http://secunia.com/advisories/product/11901/
DESCRIPTION:
Some security issues have been reported in Adobe Flash Player, which
can be exploited by malicious people to bypass certain security
restrictions or manipulate certain data.
1) An error while enforcing cross-domain policy files can be
exploited to bypass certain security restrictions.
This is related to vulnerability #4 in:
SA28161
2) An ActionScript implementation error can be exploited to determine
if a port on a remote host is opened or closed.
This is related to vulnerability #8 in:
SA28161
3) The problem is that the "FileReference.browse()" and
"FileReference.download()" methods can be called without user
interaction and can potentially be used to trick a user into
downloading or uploading files.
The security issues are reported in version 9.0.124.0 and prior.
SOLUTION:
Upgrade to version 10.0.12.36. An update for the 9.x branch will
reportedly be available in early November.
PROVIDED AND/OR DISCOVERED BY:
1, 3) Reported by the vendor.
2) The vendor credits fukami of SektionEins.
ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb08-18.html
OTHER REFERENCES:
SA28161:
http://secunia.com/advisories/28161/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------