Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.

An updated Adobe Flash Player package that fixes a security issue is now available for Red Hat Enterprise Linux 3 Extras, 4 Extras, and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The flash-plugin package contains a Firefox-compatible Adobe Flash Player Web browser plug-in.

Several input validation flaws were found in the way Flash Player displays certain content. It may be possible to execute arbitrary code on a victim's machine, if the victim opens a malicious Adobe Flash file. (CVE-2007-4768, CVE-2007-6242, CVE-2007-6246)

A flaw was found in the way Flash Player handled the asfunction:
protocol. Malformed SWF files could perform a cross-site scripting attack. (CVE-2007-6244)

A flaw was found in the way Flash Player modified HTTP request headers. Malicious content could allow Flash Player to conduct a HTTP response splitting attack. (CVE-2007-6245)

A flaw was found in the way Flash Player processes certain SWF content. A malicious SWF file could allow a remote attacker to conduct a port scanning attack from the client's machine. (CVE-2007-4324)

A flaw was found in the way Flash Player establishes TCP sessions. A remote attacker could use Flash Player to conduct a DNS rebinding attack. (CVE-2007-5275)

Users of Adobe Flash Player are advised to upgrade to this updated package, which contains version 9.0.115.0 and resolves these issues.

Multiple vulnerabilities were discovered by Tavis Ormandy and Will Drewry in the way that pcre handled certain malformed regular expressions. If an application linked against pcre, such as Konqueror, parses a malicious regular expression, it could lead to the execution of arbitrary code as the user running the application.

Updated packages have been patched to prevent this issue.

Andrews Salomon reported that kazehakase, a GTK+-based web browser that allows pluggable rendering engines, contained an embedded copy of the PCRE library in its source tree which was compiled in and used in preference to the system-wide version of this library.

The PCRE library has been updated to fix the security issues reported against it in previous Debian Security Advisories. This update ensures that kazehakase uses that supported library, and not its own embedded and insecure version.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

This update re-based pcre to version 7.3 as used in Fedora 8 to address multiple security issues that cause memory corruption, leading to application crash or possible execution of arbitrary code.
CVE-2007-1659 (#315871), CVE-2007-1661 (#392931), CVE-2007-1662 (#392921), CVE-2007-4766 (#392891), CVE-2007-4767 (#392901), CVE-2007-4768 (#392911), CVE-2008-0674 (#431660) This issue may affect usages of pcre, where regular expressions from untrusted sources are compiled. Handling of untrusted data using trusted regular expressions is not affected by these problems.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200801-07 (Adobe Flash Player: Multiple vulnerabilities)

    Flash contains a copy of PCRE which is vulnerable to a heap-based     buffer overflow (GLSA 200711-30, CVE-2007-4768).
    Aaron Portnoy reported an unspecified vulnerability related to     input validation (CVE-2007-6242).
    Jesse Michael and Thomas Biege reported that Flash does not     correctly set memory permissions (CVE-2007-6246).
    Dan Boneh, Adam Barth, Andrew Bortz, Collin Jackson, and Weidong     Shao reported that Flash does not pin DNS hostnames to a single IP     addresses, allowing for DNS rebinding attacks (CVE-2007-5275).
    David Neu reported an error withing the implementation of the     Socket and XMLSocket ActionScript 3 classes (CVE-2007-4324).
    Toshiharu Sugiyama reported that Flash does not sufficiently     restrict the interpretation and usage of cross-domain policy files,     allowing for easier cross-site scripting attacks (CVE-2007-6243).
    Rich Cannings reported a cross-site scripting vulnerability in the     way the 'asfunction:' protocol was handled (CVE-2007-6244).
    Toshiharu Sugiyama discovered that Flash allows remote attackers to     modify HTTP headers for client requests and conduct HTTP Request     Splitting attacks (CVE-2007-6245).
  Impact :

    A remote attacker could entice a user to open a specially crafted file     (usually in a web browser), possibly leading to the execution of     arbitrary code with the privileges of the user running the Adobe Flash     Player. The attacker could also cause a user's machine to establish TCP     sessions with arbitrary hosts, bypass the Security Sandbox Model,     obtain sensitive information, port scan arbitrary hosts, or conduct     cross-site-scripting attacks.
  Workaround :

    There is no known workaround at this time.

Adobe Security bulletin :

Critical vulnerabilities have been identified in Adobe Flash Player that could allow an attacker who successfully exploits these potential vulnerabilities to take control of the affected system. A malicious SWF must be loaded in Flash Player by the user for an attacker to exploit these potential vulnerabilities. Users are recommended to update to the most current version of Flash Player available for their platform.

This flash player update to version 9.0.115.0 fixes several security problems. In the worst case an attacker could potentially have flash-player execute arbitrary code via specially crafted files.
(CVE-2007-4324 / CVE-2007-4768 / CVE-2007-5275 / CVE-2007-6242 / CVE-2007-6243 / CVE-2007-6244 / CVE-2007-6245 / CVE-2007-6246)

Note: Since Adobe doesn't support browsers other than Firefox and Mozilla, this update doesn't work with browsers such as Konqueror.
Updates for konquerors are already in the works.

This flash player update to version 9.0.115.0 fixes several security problems. In the worst case an attacker could potentially have flash-player execute arbitrary code via specially crafted files.
(CVE-2007-4324, CVE-2007-4768, CVE-2007-5275, CVE-2007-6242, CVE-2007-6243, CVE-2007-6244, CVE-2007-6245, CVE-2007-6246)

Note: Since Adobe doesn't support browsers other than Firefox and Mozilla, this update doesn't work with browsers such as Konqueror.
Updates for konquerors are already in the works.

 According to its version number, the instance of Flash Player on the remote Windows host is affected by multiple issues, including several that could allow for arbitrary code execution by means of a malicious SWF file.

According to its version number, the instance of Flash Player on the remote Windows host is affected by multiple issues, including several which could allow for arbitrary code execution by means of a malicious SWF file.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2007-009 applied. 

This update contains several security fixes for a large number of programs.

Tavis Ormandy and Will Drewry discovered multiple flaws in the regular expression handling of PCRE. By tricking a user or service into running specially crafted expressions via applications linked against libpcre3, a remote attacker could crash the application, monopolize CPU resources, or possibly execute arbitrary code with the application's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200711-30 (PCRE: Multiple vulnerabilities)

    Tavis Ormandy (Google Security) discovered multiple vulnerabilities in     PCRE. He reported an error when processing '\\Q\\E' sequences with     unmatched '\\E' codes that can lead to the compiled bytecode being     corrupted (CVE-2007-1659). PCRE does not properly calculate sizes for     unspecified 'multiple forms of character class', which triggers a     buffer overflow (CVE-2007-1660). Further improper calculations of     memory boundaries were reported when matching certain input bytes     against regex patterns in non UTF-8 mode (CVE-2007-1661) and when     searching for unmatched brackets or parentheses (CVE-2007-1662).
    Multiple integer overflows when processing escape sequences may lead to     invalid memory read operations or potentially cause heap-based buffer     overflows (CVE-2007-4766). PCRE does not properly handle '\\P' and     '\\P{x}' sequences which can lead to heap-based buffer overflows or     trigger the execution of infinite loops (CVE-2007-4767), PCRE is also     prone to an error when optimizing character classes containing a     singleton UTF-8 sequence which might lead to a heap-based buffer     overflow (CVE-2007-4768).
    Chris Evans also reported multiple integer overflow vulnerabilities in     PCRE when processing a large number of named subpatterns ('name_count')     or long subpattern names ('max_name_size') (CVE-2006-7227), and via     large 'min', 'max', or 'duplength' values (CVE-2006-7228) both possibly     leading to buffer overflows. Another vulnerability was reported when     compiling patterns where the '-x' or '-i' UTF-8 options change within     the pattern, which might lead to improper memory calculations     (CVE-2006-7230).
  Impact :

    An attacker could exploit these vulnerabilities by sending specially     crafted regular expressions to applications making use of the PCRE     library, which could possibly lead to the execution of arbitrary code,     a Denial of Service or the disclosure of sensitive information.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities were discovered by Tavis Ormandy and Will Drewry in the way that pcre handled certain malformed regular expressions. If an application linked against pcre, such as Konqueror, parses a malicious regular expression, it could lead to the execution of arbitrary code as the user running the application.

Updated packages have been patched to prevent this issue.
Additionally, Corporate Server 4.0 was updated to pcre version 6.7 which corrected CVE-2006-7225, CVE-2006-7226, CVE-2006-7227, CVE-2006-7228, and CVE-2006-7230.

Debian project reports :

Tavis Ormandy of the Google Security Team has discovered several security issues in PCRE, the Perl-Compatible Regular Expression library, which potentially allow attackers to execute arbitrary code by compiling specially crafted regular expressions.

Tavis Ormandy of the Google Security Team has discovered several security issues in PCRE, the Perl-Compatible Regular Expression library, which potentially allow attackers to execute arbitrary code by compiling specially crafted regular expressions.

Version 7.0 of the PCRE library featured a major rewrite of the regular expression compiler, and it was deemed infeasible to backport the security fixes in version 7.3 to the versions in Debian's stable and oldstable distributions (6.7 and 4.5, respectively). Therefore, this update is based on version 7.4 (which includes the security bug fixes of the 7.3 version, plus several regression fixes), with special patches to improve the compatibility with the older versions. As a result, extra care is necessary when applying this update.

The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1659     Unmatched \Q\E sequences with orphan \E codes can cause     the compiled regex to become desynchronized, resulting     in corrupt bytecode that may result in multiple     exploitable conditions.

  - CVE-2007-1660     Multiple forms of character classes had their sizes     miscalculated on initial passes, resulting in too little     memory being allocated.

  - CVE-2007-1661     Multiple patterns of the form \X?\d or \P{L}?\d in     non-UTF-8 mode could backtrack before the start of the     string, possibly leaking information from the address     space, or causing a crash by reading out of bounds.

  - CVE-2007-1662     A number of routines can be fooled into reading past the     end of a string looking for unmatched parentheses or     brackets, resulting in a denial of service.

  - CVE-2007-4766     Multiple integer overflows in the processing of escape     sequences could result in heap overflows or out of     bounds reads/writes.

  - CVE-2007-4767     Multiple infinite loops and heap overflows were     discovered in the handling of \P and \P{x} sequences,     where the length of these non-standard operations was     mishandled.

  - CVE-2007-4768     Character classes containing a lone unicode sequence     were incorrectly optimised, resulting in a heap     overflow.

ID	Name	Product	Family	Severity
40711	RHEL 3 / 4 / 5 : flash-plugin (RHSA-2007:1126)	Nessus	Red Hat Local Security Checks	high
37237	Mandrake Linux Security Advisory : pcre (MDKSA-2007:211)	Nessus	Mandriva Local Security Checks	high
32144	Debian DSA-1570-1 : kazehakase - various	Nessus	Debian Local Security Checks	high
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
31363	Fedora 7 : pcre-7.3-3.fc7 (2008-1842)	Nessus	Fedora Local Security Checks	high
30031	GLSA-200801-07 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
29849	FreeBSD : linux-flashplugin -- multiple vulnerabilities (562cf6c4-b9f1-11dc-a302-000102cc8983)	Nessus	FreeBSD Local Security Checks	critical
29785	SuSE 10 Security Update : flash-player (ZYPP Patch Number 4856)	Nessus	SuSE Local Security Checks	high
29784	openSUSE 10 Security Update : flash-player (flash-player-4855)	Nessus	SuSE Local Security Checks	high
4322	Flash Player < 9.0.115.0 / 7.0.73.0 APSB07-20 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
29741	Flash Player < 7.0.73.0 / 9.0.115.0 Multiple Vulnerabilities (APSB07-20)	Nessus	Windows	high
29723	Mac OS X Multiple Vulnerabilities (Security Update 2007-009)	Nessus	MacOS X Local Security Checks	critical
28359	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : pcre3 vulnerabilities (USN-547-1)	Nessus	Ubuntu Local Security Checks	high
28319	GLSA-200711-30 : PCRE: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
27849	Mandrake Linux Security Advisory : pcre (MDKSA-2007:212)	Nessus	Mandriva Local Security Checks	high
27814	FreeBSD : pcre -- arbitrary code execution (bfd6eef4-8c94-11dc-8c55-001c2514716c)	Nessus	FreeBSD Local Security Checks	high
27629	Debian DSA-1399-1 : pcre3 - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2007-4768

critical

Tenable Plugins

high

high

high

critical

high

high

critical

high

high

high

high

critical

high

high

high

high

high