The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324.

An updated Adobe Flash Player package that fixes several security issues is now available for Red Hat Enterprise Linux 3 Extras, Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The flash-plugin package contains a Firefox-compatible Adobe Flash Player Web browser plug-in.

Several input validation flaws were found in the way Flash Player displayed certain content. These may have made it possible to execute arbitrary code on a victim's machine, if the victim opened a malicious Adobe Flash file. (CVE-2007-0071, CVE-2007-6019)

A flaw was found in the way Flash Player established TCP sessions to remote hosts. A remote attacker could, consequently, use Flash Player to conduct a DNS rebinding attack. (CVE-2007-5275, CVE-2008-1655)

A flaw was found in the way Flash Player restricted the interpretation and usage of cross-domain policy files. A remote attacker could use Flash Player to conduct cross-domain and cross-site scripting attacks.
(CVE-2007-6243, CVE-2008-1654)

A flaw was found in the way Flash Player interacted with web browsers.
An attacker could use malicious content presented by Flash Player to conduct a cross-site scripting attack. (CVE-2007-6637)

All users of Adobe Flash Player should upgrade to this updated package, which contains Flash Player version 9.0.124.0 and resolves these issues.

An updated Adobe Flash Player package that fixes a security issue is now available for Red Hat Enterprise Linux 3 Extras, 4 Extras, and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The flash-plugin package contains a Firefox-compatible Adobe Flash Player Web browser plug-in.

Several input validation flaws were found in the way Flash Player displays certain content. It may be possible to execute arbitrary code on a victim's machine, if the victim opens a malicious Adobe Flash file. (CVE-2007-4768, CVE-2007-6242, CVE-2007-6246)

A flaw was found in the way Flash Player handled the asfunction:
protocol. Malformed SWF files could perform a cross-site scripting attack. (CVE-2007-6244)

A flaw was found in the way Flash Player modified HTTP request headers. Malicious content could allow Flash Player to conduct a HTTP response splitting attack. (CVE-2007-6245)

A flaw was found in the way Flash Player processes certain SWF content. A malicious SWF file could allow a remote attacker to conduct a port scanning attack from the client's machine. (CVE-2007-4324)

A flaw was found in the way Flash Player establishes TCP sessions. A remote attacker could use Flash Player to conduct a DNS rebinding attack. (CVE-2007-5275)

Users of Adobe Flash Player are advised to upgrade to this updated package, which contains version 9.0.115.0 and resolves these issues.

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-003 applied. 

This update contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.3. 

Mac OS X 10.5.3 contains security fixes for a number of programs.

The remote host is affected by the vulnerability described in GLSA-200804-21 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Adobe Flash:
    Secunia Research and Zero Day Initiative reported a boundary error     related to DeclareFunction2 Actionscript tags in SWF files     (CVE-2007-6019).
    The ISS X-Force and the Zero Day Initiative reported an unspecified     input validation error that might lead to a buffer overflow     (CVE-2007-0071).
    Microsoft, UBsecure and JPCERT/CC reported that cross-domain policy     files are not checked before sending HTTP headers to another domain     (CVE-2008-1654) and that it does not sufficiently restrict the     interpretation and usage of cross-domain policy files (CVE-2007-6243).
    The Stanford University and Ernst and Young's Advanced Security Center     reported that Flash does not pin DNS hostnames to a single IP     addresses, allowing for DNS rebinding attacks (CVE-2007-5275,     CVE-2008-1655).
    The Google Security Team and Minded Security Multiple reported multiple     cross-site scripting vulnerabilities when passing input to Flash     functions (CVE-2007-6637).
  Impact :

    A remote attacker could entice a user to open a specially crafted file     (usually in a web browser), possibly leading to the execution of     arbitrary code with the privileges of the user running the Adobe Flash     Player. The attacker could also cause a user's machine to send HTTP     requests to other hosts, establish TCP sessions with arbitrary hosts,     bypass the security sandbox model, or conduct Cross-Site Scripting and     Cross-Site Request Forgery attacks.
  Workaround :

    There is no known workaround at this time.

This flash player update to version 9.0.124.0 fixes several security problems. In the worst case an attacker could potentially have flash-player execute arbitrary code via specially crafted files.
(CVE-2007-5275, CVE-2007-6243, CVE-2007-6637, CVE-2007-6019, CVE-2007-0071, CVE-2008-1655, CVE-2008-1654)

This flash player update to version 9.0.124.0 fixes several security problems. In the worst case an attacker could potentially have flash-player execute arbitrary code via specially crafted files.
(CVE-2007-5275 / CVE-2007-6243 / CVE-2007-6637 / CVE-2007-6019 / CVE-2007-0071 / CVE-2008-1655 / CVE-2008-1654)

According to its version number, the instance of Flash Player on the remote Windows host is affected by multiple issues, including several that could allow for arbitrary code execution.

The remote host is affected by the vulnerability described in GLSA-200801-07 (Adobe Flash Player: Multiple vulnerabilities)

    Flash contains a copy of PCRE which is vulnerable to a heap-based     buffer overflow (GLSA 200711-30, CVE-2007-4768).
    Aaron Portnoy reported an unspecified vulnerability related to     input validation (CVE-2007-6242).
    Jesse Michael and Thomas Biege reported that Flash does not     correctly set memory permissions (CVE-2007-6246).
    Dan Boneh, Adam Barth, Andrew Bortz, Collin Jackson, and Weidong     Shao reported that Flash does not pin DNS hostnames to a single IP     addresses, allowing for DNS rebinding attacks (CVE-2007-5275).
    David Neu reported an error withing the implementation of the     Socket and XMLSocket ActionScript 3 classes (CVE-2007-4324).
    Toshiharu Sugiyama reported that Flash does not sufficiently     restrict the interpretation and usage of cross-domain policy files,     allowing for easier cross-site scripting attacks (CVE-2007-6243).
    Rich Cannings reported a cross-site scripting vulnerability in the     way the 'asfunction:' protocol was handled (CVE-2007-6244).
    Toshiharu Sugiyama discovered that Flash allows remote attackers to     modify HTTP headers for client requests and conduct HTTP Request     Splitting attacks (CVE-2007-6245).
  Impact :

    A remote attacker could entice a user to open a specially crafted file     (usually in a web browser), possibly leading to the execution of     arbitrary code with the privileges of the user running the Adobe Flash     Player. The attacker could also cause a user's machine to establish TCP     sessions with arbitrary hosts, bypass the Security Sandbox Model,     obtain sensitive information, port scan arbitrary hosts, or conduct     cross-site-scripting attacks.
  Workaround :

    There is no known workaround at this time.

Adobe Security bulletin :

Critical vulnerabilities have been identified in Adobe Flash Player that could allow an attacker who successfully exploits these potential vulnerabilities to take control of the affected system. A malicious SWF must be loaded in Flash Player by the user for an attacker to exploit these potential vulnerabilities. Users are recommended to update to the most current version of Flash Player available for their platform.

This flash player update to version 9.0.115.0 fixes several security problems. In the worst case an attacker could potentially have flash-player execute arbitrary code via specially crafted files.
(CVE-2007-4324 / CVE-2007-4768 / CVE-2007-5275 / CVE-2007-6242 / CVE-2007-6243 / CVE-2007-6244 / CVE-2007-6245 / CVE-2007-6246)

Note: Since Adobe doesn't support browsers other than Firefox and Mozilla, this update doesn't work with browsers such as Konqueror.
Updates for konquerors are already in the works.

This flash player update to version 9.0.115.0 fixes several security problems. In the worst case an attacker could potentially have flash-player execute arbitrary code via specially crafted files.
(CVE-2007-4324, CVE-2007-4768, CVE-2007-5275, CVE-2007-6242, CVE-2007-6243, CVE-2007-6244, CVE-2007-6245, CVE-2007-6246)

Note: Since Adobe doesn't support browsers other than Firefox and Mozilla, this update doesn't work with browsers such as Konqueror.
Updates for konquerors are already in the works.

 According to its version number, the instance of Flash Player on the remote Windows host is affected by multiple issues, including several that could allow for arbitrary code execution by means of a malicious SWF file.

According to its version number, the instance of Flash Player on the remote Windows host is affected by multiple issues, including several which could allow for arbitrary code execution by means of a malicious SWF file.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.3.  Mac OS X 10.5.3 contains security fixes for a number of programs.

ID	Name	Product	Family	Severity
40719	RHEL 3 / 4 / 5 : flash-plugin (RHSA-2008:0221)	Nessus	Red Hat Local Security Checks	high
40711	RHEL 3 / 4 / 5 : flash-plugin (RHSA-2007:1126)	Nessus	Red Hat Local Security Checks	high
32478	Mac OS X Multiple Vulnerabilities (Security Update 2008-003)	Nessus	MacOS X Local Security Checks	critical
32477	Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
32014	GLSA-200804-21 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
31965	openSUSE 10 Security Update : flash-player (flash-player-5161)	Nessus	SuSE Local Security Checks	high
31964	SuSE 10 Security Update : flash-player (ZYPP Patch Number 5159)	Nessus	SuSE Local Security Checks	high
4461	Flash Player < 9.0.124.0 APSB08-11 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
31799	Flash Player < 8.0.42.0 / 9.0.124.0 Multiple Vulnerabilities (APSB08-11)	Nessus	Windows	high
30031	GLSA-200801-07 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
29849	FreeBSD : linux-flashplugin -- multiple vulnerabilities (562cf6c4-b9f1-11dc-a302-000102cc8983)	Nessus	FreeBSD Local Security Checks	critical
29785	SuSE 10 Security Update : flash-player (ZYPP Patch Number 4856)	Nessus	SuSE Local Security Checks	high
29784	openSUSE 10 Security Update : flash-player (flash-player-4855)	Nessus	SuSE Local Security Checks	high
4322	Flash Player < 9.0.115.0 / 7.0.73.0 APSB07-20 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
29741	Flash Player < 7.0.73.0 / 9.0.115.0 Multiple Vulnerabilities (APSB07-20)	Nessus	Windows	high
4523	Mac OS X < 10.5.3	Nessus Network Monitor	Generic	critical

Detections

Analytics

CVE-2007-5275

critical

Tenable Plugins

high

high

critical

critical

high

high

high

medium

high

high

critical

high

high

high

high

critical