CVE-2009-1870MEDIUM
Description
Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to obtain sensitive information via vectors involving saving an SWF file to a hard drive, related to a "local sandbox vulnerability."
References
http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html
http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html
http://secunia.com/advisories/36193
http://secunia.com/advisories/36374
http://secunia.com/advisories/36701
http://security.gentoo.org/glsa/glsa-200908-04.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1
http://support.apple.com/kb/HT3864
http://support.apple.com/kb/HT3865
http://www.adobe.com/support/security/bulletins/apsb09-10.html
http://www.adobe.com/support/security/bulletins/apsb09-13.html
http://www.securityfocus.com/bid/35890
http://www.securityfocus.com/bid/35908
http://www.securitytracker.com/id?1022629
http://www.vupen.com/english/advisories/2009/2086
https://exchange.xforce.ibmcloud.com/vulnerabilities/52180
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15887
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6648
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:adobe:air:1.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:air:1.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:air:1.5:*:*:*:*:*:*:*
cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:* versions up to 1.5.1 (inclusive)
cpe:2.3:a:adobe:flash_player:7.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.25:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.63:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.63:*:linux:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.69.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.70.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.1.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.2:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0:*:basic:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0:*:pro:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0.24.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0.34.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0.35.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0.39.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.16:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.20:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.20.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.28:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.28.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.31.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.45.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.47.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.48.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.112.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.114.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.115.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.124.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:10.0.0.584:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:10.0.12.10:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:10.0.12.36:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* versions up to 10.0.22.87 (inclusive)
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 63887 | RHEL 3 / 4 : flash-plugin (RHSA-2009:1189) | Nessus | Red Hat Local Security Checks | high |
| 63886 | RHEL 5 : flash-plugin (RHSA-2009:1188) | Nessus | Red Hat Local Security Checks | high |
| 51731 | SuSE 10 Security Update : flash-player (ZYPP Patch Number 6386) | Nessus | SuSE Local Security Checks | high |
| 42001 | openSUSE 10 Security Update : flash-player (flash-player-6387) | Nessus | SuSE Local Security Checks | high |
| 41392 | SuSE 11 Security Update : flash-player (SAT Patch Number 1149) | Nessus | SuSE Local Security Checks | high |
| 800786 | Mac OS X 10.6 < 10.6.1 Multiple Vulnerabilities | Log Correlation Engine | Operating System Detection | high |
| 5162 | Mac OS X 10.6 < 10.6.1 Multiple Vulnerabilities | Nessus Network Monitor | Generic | critical |
| 40946 | Mac OS X 10.6.x < 10.6.1 Multiple Vulnerabilities | Nessus | MacOS X Local Security Checks | critical |
| 40945 | Mac OS X Multiple Vulnerabilities (Security Update 2009-005) | Nessus | MacOS X Local Security Checks | critical |
| 40520 | GLSA-200908-04 : Adobe products: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
| 40489 | openSUSE Security Update : flash-player (flash-player-1148) | Nessus | SuSE Local Security Checks | high |
| 40488 | openSUSE Security Update : flash-player (flash-player-1148) | Nessus | SuSE Local Security Checks | high |
| 5109 | Adobe AIR < 1.5.2 Multiple Vulnerabilities (APSB09-10) | Nessus Network Monitor | Web Clients | medium |
| 40447 | Adobe AIR < 1.5.2 Multiple Vulnerabilities (APSB09-10) | Nessus | Windows | high |
| 40434 | Flash Player < 9.0.246.0 / 10.0.32.18 Multiple Vulnerabilities (APSB09-10) | Nessus | Windows | high |