Signature Detail

HTTP: Adobe Flash Player JPG Embedded SWF Processing Heap Overflow

This signature detects attempts to exploit a known buffer overflow vulnerability in Adobe Flash Player in the way it processes SWF files embedding JPG images. It is due to lack of input validation while parsing height and width fields in the JPG header. A remote attacker can exploit this by enticing the target user to open malicious SWF files, potentially causing arbitrary code to be injected and executed in the security context of the logged-in user.

Extended Description

Adobe Flash Player is prone to a remote heap-based buffer-overflow vulnerability because the application fails to use consistent signedness when handling user-supplied input. An attacker can exploit this issue to execute arbitrary code with the privileges of a user running the application. Failed exploit attempts will likely cause denial-of-service conditions. This issue affects Adobe Flash Player 9.0.48.0, 8.0.35.0, 7.0.70.0, and prior versions. NOTE: This issue was originally covered by BID 26929 (Adobe Flash Player Multiple Security Vulnerabilities).

Affected Products

• Adobe flash_player 7.0.69.0
• Adobe flash_player 7.0.70.0
• Adobe flash_player 8.0.34.0
• Adobe flash_player 8.0.35.0
• Adobe flash_player 9.0.28.0
• Adobe flash_player 9.0.31.0
• Adobe flash_player 9.0.45.0
• Adobe flash_player 9.0.47.0
• Adobe flash_player 9.0.48.0
• Gentoo linux
• Nortel_networks media_processing_svr_1000_rel 3.0
• Nortel_networks self-service-ccss7
• Nortel_networks self-service_peri_application
• Nortel_networks self-service_peri_workstation
• Red_hat advanced_workstation_for_the_itanium_processor 2.1.0
• Red_hat enterprise_linux_desktop_supplementary 5 Client
• Red_hat enterprise_linux_extras 3
• Red_hat enterprise_linux_extras 4
• Red_hat enterprise_linux_extras 4.5.Z
• Red_hat enterprise_linux_supplementary 5 Server
• Sun opensolaris Build Snv 88
• Sun solaris 10 Sparc
• Sun solaris 10 X86
• Suse linux_personal 10.1
• Suse linux_professional 10.1
• Suse novell_linux_desktop 9.0.0
• Suse opensuse 10.2
• Suse opensuse 10.3
• Suse suse_linux_enterprise_desktop 10 SP1
• Turbolinux fuji
• Turbolinux wizpy

References

• BugTraq: 26951
• CVE: CVE-2007-6242