Adobe Updates for Multiple Vulnerabilities
Original release date: December 21, 2007
Last revised: --
Source: US-CERT
Systems Affected
- Adobe Flash Player 9.0.48.0 and earlier
- Adobe Flash Player 8.0.35.0 and earlier
- Adobe Flash Player 7.0.70.0 and earlier
Overview
Adobe has released Security bulletin APSB07-20 to address multiple vulnerabilities affecting Adobe Flash Player. Attackers could exploit these vulnerabilities to execute arbitrary code, perform DNS rebinding and cross-site scripting attacks, conduct port scans, or cause a denial of service.
I. Description
Adobe Security Update APSB07-20
addresses a number of vulnerabilities affecting Adobe Flash 9.0.48.0 and earlier, 8.0.35.0 and earlier and 7.0.70 and earlier. Further details are available in the related vulnerability notes.
An attacker could exploit these vulnerabilities by convincing a user to load a specially crafted Flash file. Flash content is widely deployed on the internet. An attacker could distribute Flash files using web sites that allow user-supplied content, like popular social networking sites.
II. Impact
The impacts of these vulnerabilities vary. An attacker may be able to execute arbitrary code, perform DNS rebinding or cross-site scripting attacks, conduct port scans, or cause a denial of service.
III. Solution
Upgrade Flash Player
Upgrade Flash Player according to the information in Adobe Security bulletin APSB97-20. For the port scanning issue (CVE-2007-4324), consider ActionScript network socket functionality per TechNote kb402956.
Adobe provides a way to determine which version of Flash Player is installed and a way to configure notifications of updates.
IV. References
Feedback can be directed to US-CERT.
Produced 2007 by US-CERT, a government organization. Terms of use
Revision History
December 21, 2007: Initial release
Mailing Lists & Feeds
Get Adobe Reader
US-CERT is part of the Department of Homeland Security