Alert (TA07-355A)

Systems Affected

• Adobe Flash Player 9.0.48.0 and earlier
• Adobe Flash Player 8.0.35.0 and earlier
• Adobe Flash Player 7.0.70.0 and earlier

Overview

Adobe has released Security bulletin APSB07-20 to address multiple vulnerabilities affecting Adobe Flash Player. Attackers could exploit these vulnerabilities to execute arbitrary code, perform DNS rebinding and cross-site scripting attacks, conduct port scans, or cause a denial of service.

Description

Adobe Security Update APSB07-20 addresses a number of vulnerabilities affecting Adobe Flash 9.0.48.0 and earlier, 8.0.35.0 and earlier and 7.0.70 and earlier. Further details are available in the related vulnerability notes.

An attacker could exploit these vulnerabilities by convincing a user to load a specially crafted Flash file. Flash content is widely deployed on the internet. An attacker could distribute Flash files using web sites that allow user-supplied content, like popular social networking sites.

Impact

The impacts of these vulnerabilities vary. An attacker may be able to execute arbitrary code, perform DNS rebinding or cross-site scripting attacks, conduct port scans, or cause a denial of service.

Solution

Upgrade Flash Player

Upgrade Flash Player according to the information in Adobe Security bulletin APSB97-20. For the port scanning issue (CVE-2007-4324), consider ActionScript network socket functionality per TechNote kb402956.

Adobe provides a way to determine which version of Flash Player is installed and a way to configure notifications of updates.

References

• Vulnerability notes for Adobe Security Update APSB07-20 - http://www.kb.cert.org/vuls/byid?searchview&query=APSB07-20
• Adobe Security Bulletin APSB07-20 - http://www.adobe.com/support/security/bulletins/apsb07-20.html
• Securing Your Web Browser -http://www.us-cert.gov/reading_room/securing_browser/

Revision History

• December 21, 2007: Initial release
  

Was this document helpful?  Yes  |   Somewhat  |   No