Integer overflow in Adobe Flash Player 9.0.45.0 and earlier might allow remote attackers to execute arbitrary code via a large length value for a (1) Long string or (2) XML variable type in a crafted (a) FLV or (b) SWF file, related to an "input validation error," including a signed comparison of values that are assumed to be non-negative.

An updated Adobe Flash Player package that fixes a security issue is now available for Red Hat Enterprise Linux 3 Extras, 4 Extras, and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The flash-plugin package contains a Firefox-compatible Adobe Flash Player browser plug-in.

An input validation flaw was found in the way Flash Player displayed certain content. It may be possible to execute arbitrary code on a victim's machine if the victim opens a malicious Adobe Flash file.
(CVE-2007-3456)

Users of Adobe Flash Player should upgrade to this updated package, which contains version 9.0.47.0. and is not vulnerable to this issue.

The Adobe Flash Player was updated to version 7.0.70.0 for Novell Linux Desktop 9 and to version 9.0.48.0 on SUSE Linux Enterprise Desktop 10 to fix several security problems :

  - An input validation error has been identified in Flash     Player 9.0.45.0 and earlier versions that could lead to     the potential execution of arbitrary code. This     vulnerability could be accessed through content     delivered from a remote location via the user's web     browser, email client, or other applications that     include or reference the Flash Player. (CVE-2007-3456)

  - An issue with insufficient validation of the HTTP     Referer has been identified in Flash Player 8.0.34.0 and     earlier. This issue does not affect Flash Player 9. This     issue could potentially aid an attacker in executing a     cross-site request forgery attack. (CVE-2007-3457)

  - The Linux and Solaris updates for Flash Player 7     (7.0.70.0) address the issues with Flash Player and the     Opera and Konqueror browsers described in Security     Advisory APSA07-03. These issues do not impact Flash     Player 9 on Linux or Solaris. (CVE-2007-2022)

The affected webbrowsers Opera and konqueror have already been fixed independendly.

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.11 or a version of Mac OS X 10.3 that does not have Security Update 2007-008 applied.  This update contains several security fixes for the following programs :


 - Flash Player Plugin
 - AppleRAID
 - BIND
 - bzip2
 - CFFTP
 - CFNetwork
 - CoreFoundation
 - CoreText
 - Kerberos
 - Kernel
 - remote_cmds
 - Networking
 - NFS
 - NSURL
 - Safari
 - SecurityAgent
 - WebCore
 - WebKit

The remote host is running a version of Mac OS X 10.4 which is older than version 10.4.11 or a version of Mac OS X 10.3 which does not have Security Update 2007-008 applied. 

This update contains several security fixes for the following programs :

 - Flash Player Plugin
 - AppleRAID
 - BIND
 - bzip2
 - CFFTP
 - CFNetwork
 - CoreFoundation
 - CoreText
 - Kerberos
 - Kernel
 - remote_cmds
 - Networking
 - NFS
 - NSURL
 - Safari
 - SecurityAgent
 - WebCore
 - WebKit

The Adobe Flash Player was updated to version 7.0.70.0 on SUSE Linux 10.0 and to version 9.0.48.0 on SUSE Linux 10.1 and openSUSE 10.2 to fix several security problems :

CVE-2007-3456: An input validation error has been identified in Flash Player 9.0.45.0 and earlier versions that could lead to the potential execution of arbitrary code. This vulnerability could be accessed through content delivered from a remote location via the user's web browser, email client, or other applications that include or reference the Flash Player.

CVE-2007-3457: An issue with insufficient validation of the HTTP Referer has been identified in Flash Player 8.0.34.0 and earlier. This issue does not affect Flash Player 9. This issue could potentially aid an attacker in executing a cross-site request forgery attack.

CVE-2007-2022: The Linux and Solaris updates for Flash Player 7 (7.0.70.0) address the issues with Flash Player and the Opera and Konqueror browsers described in Security Advisory APSA07-03. These issues do not impact Flash Player 9 on Linux or Solaris.

The affected webbrowsers Opera and konqueror have already been fixed independendly.

The remote host is affected by the vulnerability described in GLSA-200708-01 (Macromedia Flash Player: Remote arbitrary code execution)

    Mark Hills discovered some errors when interacting with a browser for     keystrokes handling (CVE-2007-2022). Stefano Di Paola and Giorgio Fedon     from Minded Security discovered a boundary error when processing FLV     files (CVE-2007-3456). An input validation error when processing HTTP     referrers has also been reported (CVE-2007-3457).
  Impact :

    A remote attacker could entice a user to open a specially crafted file,     possibly leading to the execution of arbitrary code with the privileges     of the user running the Macromedia Flash Player, or sensitive data     access.
  Workaround :

    There is no known workaround at this time.

Adobe reports :

Critical vulnerabilities have been identified in Adobe Flash Player that could allow an attacker who successfully exploits these potential vulnerabilities to take control of the affected system. A malicious SWF must be loaded in Flash Player by the user for an attacker to exploit these potential vulnerabilities.

According to its version number, the instance of Flash Player on the remote Windows host could allow for arbitrary code execution by means of a malicious SWF file. 

In addition, it may also fail to sufficiently validate the HTTP Referer header, which may aid in cross-site request forgery attacks. This issue does not, though, affect Flash Player 9.

ID	Name	Product	Family	Severity
40704	RHEL 3 / 4 / 5 : flash-plugin (RHSA-2007:0696)	Nessus	Red Hat Local Security Checks	high
29434	SuSE 10 Security Update : flash-player (ZYPP Patch Number 3890)	Nessus	SuSE Local Security Checks	high
4284	Mac OS X < 10.4.11 Multiple Vulnerabilities (Security Update 2007-008)	Nessus Network Monitor	Operating System Detection	critical
28212	Mac OS X < 10.4.11 Multiple Vulnerabilities (Security Update 2007-008)	Nessus	MacOS X Local Security Checks	critical
27221	openSUSE 10 Security Update : flash-player (flash-player-3889)	Nessus	SuSE Local Security Checks	high
25866	GLSA-200708-01 : Macromedia Flash Player: Remote arbitrary code execution	Nessus	Gentoo Local Security Checks	high
25718	FreeBSD : linux-flashplugin -- critical vulnerabilities (b42e8c32-34f6-11dc-9bc9-001921ab2fa4)	Nessus	FreeBSD Local Security Checks	high
25694	Flash Player Multiple Vulnerabilities (APSB07-12)	Nessus	Windows	high

Detections

Analytics

CVE-2007-3456

critical

Tenable Plugins

high

high

critical

critical

high

high

high

high