Flash Player <= 10.3.183.14 / 11.1.102.55 Multiple Vulnerabilities (APSB12-03)

High Nessus Network Monitor Plugin ID 6804

Synopsis

The remote host contains a browser plug-in that is affected by multiple vulnerabilities

Description

The remote host has Adobe Flash Player installed.

Versions of Flash Player 10.x equal to or earlier than 10.3.183.14 or 11.x equal to or ealier than 11.1.102.55 are potentially affected by several vulnerabilities :

- Multiple unspecified memory corruption issues exist that could lead to code execution. (CVE-2012-0751, CVE-2012-0754)

- An unspecified type confusion memory corruption vulnerability exists that could lead to code execution.(CVE-2012-0752)

- An MP4 parsing memory corruption issue exists that could lead to code execution. (CVE-2012-0753)

- Multiple unspecified security bypass vulnerabilities exist that could lead to code execution. (CVE-2012-0755, CVE-2012-0756)

- A universal cross-site scripting issue exists that could be used to take actions on a user's behalf on any website or webmail provider. (CVE-2012-0767)

Solution

Upgrade to Flash Player 10.3.183.15 / 11.1.102.62 or later.

See Also

http://www.adobe.com/support/security/bulletins/apsb12-03.html

http://zerodayinitiative.com/advisories/ZDI-12-047

http://archives.neohapsis.com/archives/fulldisclosure/2012-06/0068.html

Plugin Details

Severity: High

ID: 6804

File Name: 6804.prm

Family: Web Clients

Published: 2013/05/08

Modified: 2016/01/19

Dependencies: 1735, 8314

Nessus ID: 58001

Risk Information

Risk Factor: High

CVSSv2

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSSv3

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS3#AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS3#E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:adobe:flash_player

Patch Publication Date: 2012/02/15

Vulnerability Publication Date: 2012/02/15

Exploitable With

CANVAS (CANVAS)

Metasploit (windows/browser/adobe_flash_mp4_cprt.rb)

Reference Information

CVE: CVE-2012-0751, CVE-2012-0752, CVE-2012-0753, CVE-2012-0754, CVE-2012-0755, CVE-2012-0756, CVE-2012-0767

BID: 52032, 52033, 52034, 52035, 52036, 52037, 52040