Flash Player < 19.0.0.226 RCE (APSB15-27) (Pawn Storm)

High Nessus Network Monitor Plugin ID 8991

Synopsis

The remote host is running an outdated version of Adobe Flash Player for Internet Explorer that is affected by multiple remote code execution vulnerabilities.

Description

Versions of Adobe Flash Player prior to 19.0.0.226 are unpatched for the following vulnerabilities :

- A type confusion flaw is triggered when handling the 'IExternalizable.writeExternal()' method. (CVE-2015-7645)
- Two unspecified type confusion flaws may lead to arbitrary code execution. (CVE-2015-7647, CVE-2015-7648)

These flaws may allow a context-dependent attacker to potentially execute arbitrary code. Successful exploitation could result in a crash or potentially allowing an attacker to take control of the affected system.

Solution

Upgrade to Adobe Flash Player version 19.0.0.226 or later. If 19.x cannot be obtained, ESR version 18.0.0.255 has also been patched for these vulnerabilities.

See Also

https://helpx.adobe.com/security/products/flash-player/apsa15-05.html

https://helpx.adobe.com/security/products/flash-player/apsb15-27.html

http://arstechnica.com/security/2015/10/new-zero-day-exploit-hits-fully-patched-adobe-flash

http://www.nessus.org/u?3afe18ad

http://www.nessus.org/u?2542f353

http://www.nessus.org/u?0cb17c10

Plugin Details

Severity: High

ID: 8991

Family: Web Clients

Published: 2015/10/16

Modified: 2018/09/16

Dependencies: 5158

Risk Information

Risk Factor: High

CVSSv2

Base Score: 9.3

Temporal Score: 7.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:adobe:flash_player

Patch Publication Date: 2015/10/16

Vulnerability Publication Date: 2015/10/15

Reference Information

CVE: CVE-2015-7645, CVE-2015-7647, CVE-2015-7648