search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Adobe Flash player code execution vulnerability

Vulnerability Note VU#395473

Original Release Date: 2008-05-27 | Last Revised: 2008-06-09


Adobe Flash contains a vulnerability that may allow an attacker to run code on a system that has a vulnerable version of the Flash player installed. There are reports that this vulnerability is being actively exploited.


The Adobe Flash Player is a player for the Flash media format and enables frame-based animations and multimedia to be viewed within a web browser.

Adobe Flash Player contains a code execution vulnerability. An attacker may be able to trigger this overflow by convincing a user to open a specially crafted SWF file. The SWF file could be hosted or embedded in a web page. If an attacker can take control of a website or web server, trusted sites may exploit this vulnerability.


A remoted, unauthenticated attacker may be able to execute arbitrary code.



This issue has been addressed in the most recent version ( of Adobe Flash. Microsoft Windows users should browse to the Adobe Flash Player Support Center downloads and install the most recent version of Flash site using Internet Explorer, then repeat the process for all other installed browsers (Firefox, Opera, Safari, etc). Systems that are not running Windows should be updated by going to the Adobe Flash Player Support Center downloads and installing the most recent version of Flash with all each web browser on the system.

Users who rely their operating system vendor to provide a packaged version of Adobe Flash should confirm that they have the most recent version.

The Adobe About Flash page can determine what version of Flash a web browser is using,

Workarounds for users running Mozilla-based browsers

    • Using the Mozilla Firefox NoScript extension to whitelist websites that can run scripts and access installed plugins may prevent this vulnerability from being exploited. Note that NoScript is not likely to stop all attack vectors for this vulnerability, see the NoScript FAQ for more information.
    • On Linux systems, the Flash player can be disabled by renaming the Flash plugin. The plugin may be found in several locations, including /usr/lib/firefox/plugins /usr/lib/iceweael/plugins /usr/lib/mozilla/plugins, and is named
    • Firefox 3 users can disable the Flash plugin by going to tools, Add-ons, then clicking the Disable button next to the Shockwave Flash plugin. Note that this setting only applies to Mozilla Firefox, and other browsers such as Mozilla, Konqueror, Opera, and Epiphany will still be able to access the Flash plugin.

Workarounds for users running Internet Explorer
    • Applying the kill bit for the following CLSID will prevent the Flash plugin from running:
      More information about how to set the kill bit is available in Microsoft Support Document 240797.
Workarounds for web server administrators
    • Ensure that security updates are applied to software running on the server.
    • Reverse proxy servers and web application firewalls may be able to detect and block some attacks. Administrators may also use iptables string matching to block or whitelist the Flash MIME type (application/x-shockwave-flash). Note that firewalls and IPS systems are not likely to stop all attacks.
    • Administrators and web developers should confirm that third parties (such as ad providers) hosting content on their domains are not acting as attack vectors for this vulnerability.

Workarounds for network administrators
    • Firewall, web proxies and IPS systems may be able to stop some attacks. Iptables string matching or the Squid req_mime_type ACL can be used to block access by restricting which sites can send the Flash MIME type (application/x-shockwave-flash). For example, the below iptables command will log all packets that contain the string x-shockwave-flash. Note that this filter can be circumvented by using IPS evasion techniques.
      iptables -A INPUT -m string --algo bm --string 'x-shockwave-flash' -j LOG --log-prefix FLASH

Vendor Information


Adobe Affected

Notified:  May 27, 2008 Updated: May 27, 2008



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

CVSS Metrics

Group Score Vector



Thanks to SANS for information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

CVE IDs: None
Severity Metric: 65.81
Date Public: 2008-05-27
Date First Published: 2008-05-27
Date Last Updated: 2008-06-09 12:40 UTC
Document Revision: 38

Sponsored by CISA.