Vulnerability Note VU#146284

Macromedia Flash Player fails to properly validate the frame type identifier read from a "SWF" file

Overview

A buffer overflow vulnerability in some versions of the Macromedia Flash Player may allow a remote attacker to execute code on a vulnerable system.

I. Description

The Macromedia Flash Player is a player for the Flash media format and enables frame-based animations with sound to be viewed within a web browser.

Some versions of the Flash Player, specifically 7.0.53.0 and earlier, contain an array bounds checking error in the way that they handle a frame type identifier read from the Flash (SWF) file. This error can results in a heap memory access vulnerability that could allow an attacker to execute arbitrary code. A maliciously crafted SWF that exploits this vulnerability could be supplied through a web page, for example.

Note that vulnerable versions of the Flash Player are provided with a number of versions of Microsoft Windows, Apple's Mac OS X, and some distributions of the Linux operating systems.

II. Impact

A remote attacker with the ability to supply a specially crafted SWF file to a vulnerable host may be able to execute arbitrary code on that system. The attacker-supplied code would be executed with the privileges of the user opening the file.

III. Solution

Apply a patch

Patches have been released in response to this issue. Please see the Systems Affected section of this document for more information.

Workarounds

Microsoft has published a number of workarounds for users of the affected products on Microsoft Windows platforms. Please see the Workarounds section of Microsoft Security Bulletin MS06-020 for more information.

Systems Affected

Vendor	Status	Date Notified
Apple Computer, Inc.	Vulnerable	9-May-2006
Gentoo Linux	Vulnerable	28-Nov-2005
Macromedia, Inc.	Vulnerable	15-Nov-2005
Microsoft Corporation	Vulnerable	9-May-2006
Red Hat, Inc.	Vulnerable	11-Nov-2005

References

http://www.eeye.com/html/research/advisories/AD20051104.html
http://www.sec-consult.com/228.html
http://www.macromedia.com/devnet/security/security_zone/mpsb05-07.html
http://secunia.com/advisories/17430/
http://secunia.com/advisories/17481/
http://secunia.com/advisories/17437/
http://www.securityfocus.com/bid/15332
http://blogs.technet.com/msrc/archive/2005/11/07/413906.aspx
http://www.microsoft.com/technet/security/advisory/910550.mspx
http://www.microsoft.com/technet/security/Bulletin/MS06-020.mspx

Credit

The CERT/CC credits eEye Digital Security and SEC Consult for reporting this vulnerability.

This document was written by Chad R Dougherty based on information provided by Macromedia, Inc. and eEye Digital Security.

Other Information

Date Public:	2005-11-07
Date First Published:	2005-11-11
Date Last Updated:	2006-05-09
CERT Advisory:
CVE-ID(s):	CVE-2005-2628
NVD-ID(s):	CVE-2005-2628
US-CERT Technical Alerts:
Metric:	13.50
Document Revision:	19

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2005 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader