Vulnerabilities > CVE-2009-0519 - Improper Input Validation vulnerability in Adobe products

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
adobe
CWE-20
critical
nessus

Summary

Unspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a crafted Shockwave Flash (aka .swf) file.

Vulnerable Configurations

Part Description Count
Application
Adobe
88

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Server Side Include (SSI) Injection
    An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
  • Cross Zone Scripting
    An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_FLASH-PLAYER-6022.NASL
    descriptionSpecially crafted swf files could cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute code on the victim
    last seen2020-06-01
    modified2020-06-02
    plugin id35747
    published2009-02-27
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/35747
    titleopenSUSE 10 Security Update : flash-player (flash-player-6022)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update flash-player-6022.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(35747);
      script_version ("1.12");
      script_cvs_date("Date: 2019/10/25 13:36:36");
    
      script_cve_id("CVE-2009-0114", "CVE-2009-0519", "CVE-2009-0520", "CVE-2009-0521");
    
      script_name(english:"openSUSE 10 Security Update : flash-player (flash-player-6022)");
      script_summary(english:"Check for the flash-player-6022 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Specially crafted swf files could cause a buffer overflow in
    flash-player. Attackers could potentially exploit that to execute code
    on the victim's machine (CVE-2009-0519, CVE-2009-0520, CVE-2009-0114,
    CVE-2009-0521)."
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected flash-player package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_cwe_id(20, 119, 200);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:flash-player");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.3");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/02/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/02/27");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE10\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.3", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686)$") audit(AUDIT_ARCH_NOT, "i586 / i686", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE10.3", reference:"flash-player-9.0.159.0-0.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "flash-player");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2009-0334.NASL
    descriptionAn updated Adobe Flash Player package that fixes several security issues is now available for Red Hat Enterprise Linux 3 and 4 Extras. This update has been rated as having critical security impact by the Red Hat Security Response Team. The flash-plugin package contains a Firefox-compatible Adobe Flash Player Web browser plug-in. Multiple input validation flaws were found in the way Flash Player displayed certain SWF (Shockwave Flash) content. An attacker could use these flaws to create a specially crafted SWF file that could cause flash-plugin to crash, or, possibly, execute arbitrary code when the victim loaded a page containing the specially crafted SWF content. (CVE-2009-0520, CVE-2009-0519) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 9.0.159.0.
    last seen2020-06-01
    modified2020-06-02
    plugin id63873
    published2013-01-24
    reporterThis script is Copyright (C) 2013-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/63873
    titleRHEL 3 / 4 : flash-plugin (RHSA-2009:0334)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_FLASH-PLAYER-6020.NASL
    descriptionSpecially crafted swf files could cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute code on the victim
    last seen2020-06-01
    modified2020-06-02
    plugin id51730
    published2011-01-27
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/51730
    titleSuSE 10 Security Update : flash-player (ZYPP Patch Number 6020)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200903-23.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200903-23 (Adobe Flash Player: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Adobe Flash Player: The access scope of SystemsetClipboard() allows ActionScript programs to execute the method without user interaction (CVE-2008-3873). The access scope of FileReference.browse() and FileReference.download() allows ActionScript programs to execute the methods without user interaction (CVE-2008-4401). The Settings Manager controls can be disguised as normal graphical elements. This so-called
    last seen2020-06-01
    modified2020-06-02
    plugin id35904
    published2009-03-11
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/35904
    titleGLSA-200903-23 : Adobe Flash Player: Multiple vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_FLASH-PLAYER-090316.NASL
    descriptionSpecially crafted swf files could cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute code on the victim
    last seen2020-06-01
    modified2020-06-02
    plugin id41391
    published2009-09-24
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/41391
    titleSuSE 11 Security Update : flash-player (SAT Patch Number 612)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_10_5_7.NASL
    descriptionThe remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.7. Mac OS X 10.5.7 contains security fixes for the following products : - Apache - ATS - BIND - CFNetwork - CoreGraphics - Cscope - CUPS - Disk Images - enscript - Flash Player plug-in - Help Viewer - iChat - International Components for Unicode - IPSec - Kerberos - Kernel - Launch Services - libxml - Net-SNMP - Network Time - Networking - OpenSSL - PHP - QuickDraw Manager - ruby - Safari - Spotlight - system_cmds - telnet - Terminal - WebKit - X11
    last seen2020-06-01
    modified2020-06-02
    plugin id38744
    published2009-05-13
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/38744
    titleMac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2009-0332.NASL
    descriptionAn updated Adobe Flash Player package that fixes several security issues is now available for Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. The flash-plugin package contains a Firefox-compatible Adobe Flash Player Web browser plug-in. Multiple input validation flaws were found in the way Flash Player displayed certain SWF (Shockwave Flash) content. An attacker could use these flaws to create a specially crafted SWF file that could cause flash-plugin to crash, or, possibly, execute arbitrary code when the victim loaded a page containing the specially crafted SWF content. (CVE-2009-0520, CVE-2009-0519) It was discovered that Adobe Flash Player had an insecure RPATH (runtime library search path) set in the ELF (Executable and Linking Format) header. A local user with write access to the directory pointed to by RPATH could use this flaw to execute arbitrary code with the privileges of the user running Adobe Flash Player. (CVE-2009-0521) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 10.0.22.87.
    last seen2020-06-01
    modified2020-06-02
    plugin id63872
    published2013-01-24
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63872
    titleRHEL 5 : flash-plugin (RHSA-2009:0332)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_FLASH-PLAYER-090226.NASL
    descriptionSpecially crafted swf files could cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute code on the victim
    last seen2020-06-01
    modified2020-06-02
    plugin id39962
    published2009-07-21
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/39962
    titleopenSUSE Security Update : flash-player (flash-player-560)
  • NASL familyWindows
    NASL idFLASH_PLAYER_APSB09_01.NASL
    descriptionThe remote Windows host contains a version of Adobe Flash Player that is earlier than 9.0.159.0 / 10.0.22.87. Such versions are reportedly affected by multiple vulnerabilities : - A buffer overflow issue that could allow an attacker to execute arbitrary code with the privileges of the user running the application. (CVE-2009-0520) - An input validation vulnerability that leads to a denial of service attack and could possibly allow for an attacker to execute arbitrary code. (CVE-2009-0519) - A vulnerability in the Flash Player settings manager that could contribute to a clickjacking attack. (CVE-2009-0014) - A vulnerability with the mouse pointer display that could contribute to a clickjacking attack. (CVE-2009-0522)
    last seen2020-06-01
    modified2020-06-02
    plugin id35742
    published2009-02-26
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/35742
    titleFlash Player 9.0.159.0 / 10.0.22.87 Multiple Vulnerabilities (APSB09-01)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_FLASH-PLAYER-090225.NASL
    descriptionSpecially crafted swf files could cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute code on the victim
    last seen2020-06-01
    modified2020-06-02
    plugin id40216
    published2009-07-21
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40216
    titleopenSUSE Security Update : flash-player (flash-player-560)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2009-002.NASL
    descriptionThe remote host is running a version of Mac OS X 10.4 that does not have Security Update 2009-002 applied. This security update contains fixes for the following products : - Apache - ATS - BIND - CoreGraphics - Cscope - CUPS - Disk Images - enscript - Flash Player plug-in - Help Viewer - IPSec - Kerberos - Launch Services - libxml - Net-SNMP - Network Time - OpenSSL - QuickDraw Manager - Spotlight - system_cmds - telnet - Terminal - X11
    last seen2020-06-01
    modified2020-06-02
    plugin id38743
    published2009-05-13
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/38743
    titleMac OS X Multiple Vulnerabilities (Security Update 2009-002)

Oval

  • accepted2013-02-04T04:00:17.159-05:00
    classvulnerability
    contributors
    nameShane Shaffer
    organizationG2, Inc.
    definition_extensions
    • commentAdobe Flash Player is Installed
      ovaloval:org.mitre.oval:def:12319
    • commentAdobe Flash Player 10 is Installed
      ovaloval:org.mitre.oval:def:12412
    descriptionUnspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a crafted Shockwave Flash (aka .swf) file.
    familymacos
    idoval:org.mitre.oval:def:15837
    statusaccepted
    submitted2012-12-20T15:35:55.661-05:00
    titleAdobe Flash Player Unspecified Remote Denial of Service Vulnerability
    version4
  • accepted2015-03-16T04:01:57.123-04:00
    classvulnerability
    contributors
    • namePrabhu S A
      organizationSecPod Technologies
    • nameJ. Daniel Brown
      organizationDTCC
    • nameShane Shaffer
      organizationG2, Inc.
    • nameMaria Kedovskaya
      organizationALTX-SOFT
    • nameMaria Kedovskaya
      organizationALTX-SOFT
    • nameMaria Mikhno
      organizationALTX-SOFT
    • nameMaria Mikhno
      organizationALTX-SOFT
    definition_extensions
    • commentAdobe Flash Player is installed
      ovaloval:org.mitre.oval:def:6700
    • commentAdobe AIR is installed
      ovaloval:org.mitre.oval:def:7479
    descriptionUnspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a crafted Shockwave Flash (aka .swf) file.
    familywindows
    idoval:org.mitre.oval:def:6470
    statusaccepted
    submitted2009-11-30T03:25:55
    titleAdobe Flash Player Unspecified Remote Denial of Service Vulnerability
    version62

Redhat

advisories
  • rhsa
    idRHSA-2009:0332
  • rhsa
    idRHSA-2009:0334
rpms
  • flash-plugin-0:10.0.22.87-1.el5
  • flash-plugin-0:9.0.159.0-1.el3.with.oss
  • flash-plugin-0:9.0.159.0-1.el4