Vulnerability Note VU#128491

Macromedia Flash Player continues to download flash files until browser is closed

Overview

Macromedia Flash 6 does not terminate connections when a web user leaves the page. These connections may consume excessive amounts of bandwidth and limit the flow of other data.

I. Description

The Macromedia Flash media format enables frame-based animations with sound to be viewed within a web browser. Flash uses a scripting language called ActionScript, which includes the commands loadMovie and loadSound to download associated video and audio clips.

It is typical and generally expected for downloads of embedded web page elements to cease when a user leaves one web page for another. However, in version 6 of the Flash player plug-in for Microsoft Internet Explorer (IE), connections started by the loadMovie and loadSound commands persist after the user has left the web page containing the Flash animation. These connections remain open for downloading video or audio, which can be relatively large and exhaustive of the user's bandwidth to the Internet.

II. Impact

An attacker could trick a victim into downloading a maliciously crafted Flash animation from the Web. Upon playback of the malicious animation, the victim's Flash Player software would open several multimedia connections and consume all available bandwidth, effectively making the Internet unusable until the victim closed IE.

III. Solution

Update Flash Player 6 to a version later than 6,0,25,0. For more info, see:

http://www.macromedia.com/software/flashplayer/
If you notice sluggishness in Internet connections after visiting a page containing a Flash animation, try closing IE to terminate any Flash connections.

Systems Affected

Vendor	Status	Date Updated
Macromedia Inc.	Vulnerable	12-Jun-2002

References

http://board.flashkit.com/board/showthread.php?threadid=287626
http://www.actionscript.com/archives/bandwidth.jpg
http://www.myrecords.com/mixtape/mixtape.html
http://www.securityfocus.com/bid/4567

Credit

Thanks to Dan Browder for reporting this vulnerability.

This document was written by Shawn Van Ittersum.

Other Information

Date Public	04/03/2002
Date First Published	08/08/2002 08:26:14 PM
Date Last Updated	12/10/2002
CERT Advisory
CVE-ID(s)
NVD-ID(s)
US-CERT Technical Alerts
Metric	0.85
Document Revision	14

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader