Vulnerability Note VU#395473

Adobe Flash player code execution vulnerability

This issue has been addressed in the most recent version (9.0.124.0) of Adobe Flash. Microsoft Windows users should browse to the Adobe Flash Player Support Center downloads and install the most recent version of Flash site using Internet Explorer, then repeat the process for all other installed browsers (Firefox, Opera, Safari, etc). Systems that are not running Windows should be updated by going to the Adobe Flash Player Support Center downloads and installing the most recent version of Flash with all each web browser on the system.

Users who rely their operating system vendor to provide a packaged version of Adobe Flash should confirm that they have the most recent version.

The Adobe About Flash page can determine what version of Flash a web browser is using,

Workarounds for users running Mozilla-based browsers

• Using the Mozilla Firefox NoScript extension to whitelist websites that can run scripts and access installed plugins may prevent this vulnerability from being exploited. Note that NoScript is not likely to stop all attack vectors for this vulnerability, see the NoScript FAQ for more information.
• On Linux systems, the Flash player can be disabled by renaming the Flash plugin. The plugin may be found in several locations, including /usr/lib/firefox/plugins /usr/lib/iceweael/plugins /usr/lib/mozilla/plugins, and is named flashplugin-alternative.so
• Firefox 3 users can disable the Flash plugin by going to tools, Add-ons, then clicking the Disable button next to the Shockwave Flash plugin. Note that this setting only applies to Mozilla Firefox, and other browsers such as Mozilla, Konqueror, Opera, and Epiphany will still be able to access the Flash plugin.

• Applying the kill bit for the following CLSID will prevent the Flash plugin from running:
  {D27CDB6E-AE6D-11cf-96B8-444553540000}
  More information about how to set the kill bit is available in Microsoft Support Document 240797.
  

• Ensure that security updates are applied to software running on the server.
• Reverse proxy servers and web application firewalls may be able to detect and block some attacks. Administrators may also use iptables string matching to block or whitelist the Flash MIME type (application/x-shockwave-flash). Note that firewalls and IPS systems are not likely to stop all attacks.
• Administrators and web developers should confirm that third parties (such as ad providers) hosting content on their domains are not acting as attack vectors for this vulnerability.

• Firewall, web proxies and IPS systems may be able to stop some attacks. Iptables string matching or the Squid req_mime_type ACL can be used to block access by restricting which sites can send the Flash MIME type (application/x-shockwave-flash). For example, the below iptables command will log all packets that contain the string x-shockwave-flash. Note that this filter can be circumvented by using IPS evasion techniques.
  iptables -A INPUT -m string --algo bm --string 'x-shockwave-flash' -j LOG --log-prefix FLASH

http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash
http://www.adobe.com/products/flash/about/
http://isc.sans.org/diary.html?storyid=4465
http://blogs.adobe.com/psirt/2008/05/potential_flash_player_issue.html
http://www.kb.cert.org/vuls/id/159523
http://www.securityfocus.com/bid/29386
http://noscript.net/
http://www.stopbadware.org/home/security
http://www.owasp.org/index.php/Web_Application_Firewall
http://ddanchev.blogspot.com/2008/05/malware-attack-exploiting-flash-zero.html
http://www.symantec.com/security_response/threatcon/index.jsp
http://www.netfilter.org/documentation/HOWTO//netfilter-extensions-HOWTO-3.html#ss3.18
http://www.visolve.com/squid/squid24s1/access_controls.php
http://kb.adobe.com/selfservice/viewContent.do?externalId=tn_4151

Credit

Thanks to SANS for information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.