Vulnerability Note VU#475645

Macromedia Flash plug-in contains buffer overflow

Overview

Incorrectly formatted sound wave (SWF) files may cause a buffer overflow in the Macromedia Flash plug-in.

I. Description

If the length fields in an SWF file specify fewer data than are actually present in the file, processing the file may cause a buffer overflow in the Macromedia Flash plug-in.

II. Impact

The plug-in or browser may crash. Since this buffer is only read from, this overflow is unlikely to cause execution of malicious code.

III. Solution

While Macromedia did not produce a patch to correct this problem, it is possible that recent versions of the plug-in have corrected this problem.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Macromedia	Vulnerable	15-May-2001

References

http://www.securityfocus.com/bid/2162

Credit

Neal Krawetz published the intial description of this problem.

This document was last modified by Tim Shimeall

Other Information

Date Public:	2000-12-29
Date First Published:	2001-05-17
Date Last Updated:	2001-06-20
CERT Advisory:
CVE-ID(s):	CAN-2001-0166
NVD-ID(s):	CAN-2001-0166
US-CERT Technical Alerts:
Metric:	0.49
Document Revision:	12

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader