The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Adobe Flash Player DeclareFunction2 Invalid Object Use Vulnerability
------------------------------------------------------------------------
SUMMARY
A vulnerability allows remote attackers to execute code on vulnerable
installations of Adobe's Flash Player. User interaction is required in
that a user must visit a malicious web site.
DETAILS
Vulnerable Systems:
* Adobe Flash Player version 9.0.115.0 and earlier
* Adobe Flash Player version 8.0.39.0 and earlier
Immune Systems:
* Adobe Flash Player version 9.0.124.0
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6019>
CVE-2007-6019
The specific flaw exists when the Flash player attempts to access embedded
Actionscript objects that have not been properly instantiated. In order
for exploitation to occur, an attacker would have to modify a
DeclareFunction2 Actionscript tag within an SWF file. Exploitation of this
vulnerability can result in arbitrary code execution under the context of
the currently logged in user.
ADDITIONAL INFORMATION
The information has been provided by <mailto:zdi-disclosures@3com.com>
The Zero Day Initiative.
The original article can be found at:
<http://www.zerodayinitiative.com/advisories/ZDI-08-021>
http://www.zerodayinitiative.com/advisories/ZDI-08-021
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
