Vulnerabilities > CVE-2009-1862 - Out-of-bounds Write vulnerability in Adobe Acrobat, Acrobat Reader and Flash Player

047910
CVSS 7.8 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
local
low complexity
adobe
CWE-787
nessus

Summary

Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.

Common Weakness Enumeration (CWE)

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_FLASH-PLAYER-090731.NASL
    descriptionSpecially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code. (CVE-2009-1862 / CVE-2009-0901 / CVE-2009-2395 / CVE-2009-2493 / CVE-2009-1863 / CVE-2009-1864 / CVE-2009-1865 / CVE-2009-1866 / CVE-2009-1867 / CVE-2009-1868 / CVE-2009-1869 / CVE-2009-1870)
    last seen2020-06-01
    modified2020-06-02
    plugin id41392
    published2009-09-24
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/41392
    titleSuSE 11 Security Update : flash-player (SAT Patch Number 1149)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from SuSE 11 update information. The text itself is
    # copyright (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(41392);
      script_version("1.18");
      script_cvs_date("Date: 2019/10/25 13:36:35");
    
      script_cve_id("CVE-2009-0901", "CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870", "CVE-2009-2395", "CVE-2009-2493");
    
      script_name(english:"SuSE 11 Security Update : flash-player (SAT Patch Number 1149)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 11 host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Specially crafted Flash (SWF) files can cause a buffer overflow in
    flash-player. Attackers could potentially exploit that to execute
    arbitrary code. (CVE-2009-1862 / CVE-2009-0901 / CVE-2009-2395 /
    CVE-2009-2493 / CVE-2009-1863 / CVE-2009-1864 / CVE-2009-1865 /
    CVE-2009-1866 / CVE-2009-1867 / CVE-2009-1868 / CVE-2009-1869 /
    CVE-2009-1870)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=524508"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-0901.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1862.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1863.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1864.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1865.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1866.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1867.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1868.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1869.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1870.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-2395.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-2493.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply SAT patch number 1149.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 89, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:flash-player");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/09/24");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);
    
    pl = get_kb_item("Host/SuSE/patchlevel");
    if (pl) audit(AUDIT_OS_NOT, "SuSE 11.0");
    
    
    flag = 0;
    if (rpm_check(release:"SLED11", sp:0, cpu:"i586", reference:"flash-player-10.0.32.18-0.1.1")) flag++;
    if (rpm_check(release:"SLED11", sp:0, cpu:"x86_64", reference:"")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyWindows
    NASL idADOBE_AIR_APSB09-10.NASL
    descriptionThe remote Windows host contains a version of Adobe AIR Player that is earlier than 1.5.2. Such versions are reportedly affected by multiple vulnerabilities : - A memory corruption vulnerability that could potentially lead to code execution. (CVE-2009-1862) - A privilege escalation vulnerability that could potentially lead to code execution. (CVE-2009-1863) - A heap overflow vulnerability that could potentially lead to code execution. (CVE-2009-1864) - A NULL pointer vulnerability that could potentially lead to code execution. (CVE-2009-1865) - A stack overflow vulnerability that could potentially lead to code execution. (CVE-2009-1866) - A clickjacking vulnerability that could allow an attacker to lure a web browser user into unknowingly clicking on a link or dialog. (CVE-2009-1867 - A URL parsing heap overflow vulnerability that could potentially lead to code execution. (CVE-2009-1868) - An integer overflow vulnerability that could potentially lead to code execution. (CVE-2009-1869) - A local sandbox vulnerability that could potentially lead to information disclosure when SWFs are saved to the hard drive. CVE-2009-1870)
    last seen2020-06-01
    modified2020-06-02
    plugin id40447
    published2009-07-31
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40447
    titleAdobe AIR < 1.5.2 Multiple Vulnerabilities (APSB09-10)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40447);
      script_version("1.19");
      script_cvs_date("Date: 2018/06/27 18:42:26");
    
      script_cve_id('CVE-2009-1862', 'CVE-2009-1863', 'CVE-2009-1864', 'CVE-2009-1865', 'CVE-2009-1866',
                    'CVE-2009-1867', 'CVE-2009-1868', 'CVE-2009-1869', 'CVE-2009-1870');
      script_bugtraq_id(35759, 35900, 35901, 35902, 35903, 35904, 35905, 35906, 35907, 35908
        # 35890                             it's been retired.
      );
    
      script_name(english:"Adobe AIR < 1.5.2 Multiple Vulnerabilities (APSB09-10)");
      script_summary(english:"Checks version of Adobe AIR");
    
       script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains a version of Adobe AIR that is affected by 
    multiple vulnerabilities.");
    
      script_set_attribute(attribute:"description", value:
    "The remote Windows host contains a version of Adobe AIR Player that 
    is earlier than 1.5.2. Such versions are reportedly affected by
    multiple vulnerabilities : 
    
      - A memory corruption vulnerability that could potentially
        lead to code execution. (CVE-2009-1862) 
    
      - A privilege escalation vulnerability that could
        potentially lead to code execution. (CVE-2009-1863) 
    
      - A heap overflow vulnerability that could potentially
        lead to code execution. (CVE-2009-1864) 
    
      - A NULL pointer vulnerability that could potentially
        lead to code execution. (CVE-2009-1865) 
    
      - A stack overflow vulnerability that could potentially
        lead to code execution. (CVE-2009-1866) 
    
      - A clickjacking vulnerability that could allow an
        attacker to lure a web browser user into unknowingly
        clicking on a link or dialog. (CVE-2009-1867
    
      - A URL parsing heap overflow vulnerability that could
        potentially lead to code execution. (CVE-2009-1868)
    
      - An integer overflow vulnerability that could potentially
        lead to code execution. (CVE-2009-1869) 
    
      - A local sandbox vulnerability that could potentially
        lead to information disclosure when SWFs are saved to
        the hard drive. CVE-2009-1870)");
    
      script_set_attribute(attribute:"see_also", value:"http://www.adobe.com/support/security/bulletins/apsb09-10.html");
      script_set_attribute(attribute:"solution", value:"Upgrade to Adobe AIR version 1.5.2 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:'vuln_publication_date', value:'2009/07/28');
      script_set_attribute(attribute:'patch_publication_date', value:'2009/07/30');
      script_set_attribute(attribute:'plugin_publication_date', value:'2009/07/31');
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:air");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
    
      script_dependencies("adobe_air_installed.nasl");
      script_require_keys("SMB/Adobe_AIR/Version");
    
      exit(0);
    }
    
    
    include("global_settings.inc");
    
    
    version_ui = get_kb_item("SMB/Adobe_AIR/Version_UI");
    version = get_kb_item("SMB/Adobe_AIR/Version");
    if (isnull(version)) exit(1, "SMB/Adobe_AIR/Version KB item is missing.");
    
    ver = split(version, sep:'.', keep:FALSE);
    for (i=0; i<max_index(ver); i++)
      ver[i] = int(ver[i]);
    
    if (
      ver[0] < 1 ||
      (
        ver[0] == 1 &&
        (
          ver[1] < 5 ||
          (ver[1] == 5 && ver[2] <= 1)
        )
      )
    )
    {
      if (report_verbosity > 0 && version_ui)
      {
        report = string(
          "\n",
          "Adobe AIR ", version_ui, " is currently installed on the remote host.\n"
        );
        security_hole(port:get_kb_item("SMB/transport"), extra:report);
      }
      else security_hole(get_kb_item("SMB/transport"));
      exit(0);
    }
    else exit(0, "The host is not affected.");
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2009-005.NASL
    descriptionThe remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied. This security update contains fixes for the following products : - Alias Manager - CarbonCore - ClamAV - ColorSync - CoreGraphics - CUPS - Flash Player plug-in - ImageIO - Launch Services - MySQL - PHP - SMB - Wiki Server
    last seen2020-06-01
    modified2020-06-02
    plugin id40945
    published2009-09-11
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40945
    titleMac OS X Multiple Vulnerabilities (Security Update 2009-005)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    if (!defined_func("bn_random")) exit(0);
    if (NASL_LEVEL < 3004) exit(0);
    
    include("compat.inc");
    
    
    if (description)
    {
      script_id(40945);
      script_version("1.21");
      script_cvs_date("Date: 2018/07/14  1:59:35");
    
      script_cve_id("CVE-2008-2079", "CVE-2008-5498", "CVE-2008-6680", "CVE-2009-0590", "CVE-2009-0591",
                    "CVE-2009-0789", "CVE-2009-0949", "CVE-2009-1241", "CVE-2009-1270", "CVE-2009-1271",
                    "CVE-2009-1272", "CVE-2009-1371", "CVE-2009-1372", "CVE-2009-1862", "CVE-2009-1863",
                    "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868",
                    "CVE-2009-1869", "CVE-2009-1870", "CVE-2009-2468", "CVE-2009-2800", "CVE-2009-2803",
                    "CVE-2009-2804", "CVE-2009-2805", "CVE-2009-2807", "CVE-2009-2809", "CVE-2009-2811",
                    "CVE-2009-2812", "CVE-2009-2813", "CVE-2009-2814");
      script_bugtraq_id(
        29106,
        33002,
        34256,
        34357,
        35759,
        36350,
        36354,
        36355,
        36357,
        36358,
        36359,
        36360,
        36361,
        36363,
        36364
      );
    
      script_name(english:"Mac OS X Multiple Vulnerabilities (Security Update 2009-005)");
      script_summary(english:"Check for the presence of Security Update 2009-005");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote host is missing a Mac OS X update that fixes various
    security issues."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is running a version of Mac OS X 10.5 or 10.4 that
    does not have Security Update 2009-005 applied.
    
    This security update contains fixes for the following products :
    
      - Alias Manager
      - CarbonCore
      - ClamAV
      - ColorSync
      - CoreGraphics
      - CUPS
      - Flash Player plug-in
      - ImageIO
      - Launch Services
      - MySQL
      - PHP
      - SMB
      - Wiki Server"
      );
      script_set_attribute(
        attribute:"see_also", 
        value:"http://support.apple.com/kb/HT3865"
      );
      script_set_attribute(
        attribute:"see_also", 
        value:"http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html"
      );
      script_set_attribute(
        attribute:"see_also", 
        value:"http://www.securityfocus.com/advisories/17867"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Install Security Update 2009-005 or later."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(20, 59, 79, 94, 119, 189, 200, 264, 287, 399);
      script_set_attribute(attribute:"patch_publication_date", value:"2009/09/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/09/11");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
      script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/MacOSX/packages", "Host/uname");
      exit(0);
    }
    
    #
    
    uname = get_kb_item("Host/uname");
    if (!uname) exit(1, "The 'Host/uname' KB item is missing.");
    
    if (egrep(pattern:"Darwin.* (8\.[0-9]\.|8\.1[01]\.)", string:uname))
    {
      packages = get_kb_item("Host/MacOSX/packages");
      if (!packages) exit(1, "The 'Host/MacOSX/packages' KB item is missing.");
    
      if (egrep(pattern:"^SecUpd(Srvr)?(2009-00[5-9]|20[1-9][0-9]-)", string:packages))
        exit(0, "The host has Security Update 2009-005 or later installed and therefore is not affected.");
      else
        security_hole(0);
    }
    else if (egrep(pattern:"Darwin.* (9\.[0-8]\.)", string:uname))
    {
      packages = get_kb_item("Host/MacOSX/packages/boms");
      if (!packages) exit(1, "The 'Host/MacOSX/packages/boms' KB item is missing.");
    
      if (egrep(pattern:"^com\.apple\.pkg\.update\.security\.(2009\.00[5-9]|20[1-9][0-9]\.[0-9]+)\.bom", string:packages))
        exit(0, "The host has Security Update 2009-005 or later installed and therefore is not affected.");
      else
        security_hole(0);
    }
    else exit(0, "The host is not affected.");
    
  • NASL familyWindows
    NASL idADOBE_ACROBAT_913.NASL
    descriptionThe version of Adobe Acrobat 9 installed on the remote host is earlier than 9.1.3. Such versions are reportedly affected by a memory corruption vulnerability that could potentially lead to code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id40806
    published2009-08-28
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40806
    titleAdobe Acrobat < 9.1.3 Flash Handling Unspecified Arbitrary Code Execution
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    include('compat.inc');
    
    
    if (description)
    {
      script_id(40806);
      script_version("1.16");
      script_cvs_date("Date: 2018/06/27 18:42:26");
    
      script_cve_id('CVE-2009-1862');
      script_bugtraq_id(35759);
    
      script_name(english:'Adobe Acrobat < 9.1.3 Flash Handling Unspecified Arbitrary Code Execution');
      script_summary(english:'Checks version of Adobe Acrobat');
    
      script_set_attribute(attribute:'synopsis', value:
    "The version of Adobe Acrobat on the remote Windows host is affected by
    a memory corruption vulnerability." );
      script_set_attribute(attribute:'description', value:
    "The version of Adobe Acrobat 9 installed on the remote host is earlier
    than 9.1.3.  Such versions are reportedly affected by a memory corruption
    vulnerability that could potentially lead to code execution."  );
      script_set_attribute(attribute:'see_also',
        value:'http://www.adobe.com/support/security/bulletins/apsb09-10.html'
      );
      script_set_attribute(
        attribute:'solution',
        value:'Upgrade to Adobe Acrobat 9.1.3 or later.'
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(94);
    
      script_set_attribute( attribute:'vuln_publication_date', value:'2009/07/28' );
      script_set_attribute( attribute:'patch_publication_date', value:'2009/07/30' );
      script_set_attribute( attribute:'plugin_publication_date', value:'2009/08/28' );
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:'Windows');
    
      script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
    
      script_dependencies('adobe_acrobat_installed.nasl');
      script_require_keys('SMB/Acrobat/Version');
    
      exit(0);
    }
    
    
    include('global_settings.inc');
    
    
    version = get_kb_item('SMB/Acrobat/Version');
    if (isnull(version)) exit(1, "The 'SMB/Acrobat/Version' KB item is missing.");
    
    ver = split(version, sep:'.', keep:FALSE);
    for (i=0; i<max_index(ver); i++)
      ver[i] = int(ver[i]);
    
    if  ( ver[0] == 9 && ( ver[1] < 1 || (ver[1] == 1 && ver[2] < 3) ) )
    {
      version_ui = get_kb_item('SMB/Acrobat/Version_UI');
      if (report_verbosity > 0 && version_ui)
      {
        path = get_kb_item('SMB/Acrobat/Path');
        if (isnull(path)) path = 'n/a';
    
        report = string(
          '\n',
          '  Path              : ', path, '\n',
          '  Installed version : ', version_ui, '\n',
          '  Fix               : 9.1.3\n'
        );
        security_hole(port:get_kb_item('SMB/transport'), extra:report);
      }
      else security_hole(get_kb_item('SMB/transport'));
    }
    else exit(0, "Acrobat "+version+" is not affected.");
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200908-04.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200908-04 (Adobe products: Multiple vulnerabilities) Multiple vulnerabilities have been reported in Adobe Flash Player: lakehu of Tencent Security Center reported an unspecified memory corruption vulnerability (CVE-2009-1862). Mike Wroe reported an unspecified vulnerability, related to
    last seen2020-06-01
    modified2020-06-02
    plugin id40520
    published2009-08-10
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40520
    titleGLSA-200908-04 : Adobe products: Multiple vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 200908-04.
    #
    # The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40520);
      script_version("1.24");
      script_cvs_date("Date: 2019/08/02 13:32:45");
    
      script_cve_id("CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870");
      script_xref(name:"GLSA", value:"200908-04");
    
      script_name(english:"GLSA-200908-04 : Adobe products: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-200908-04
    (Adobe products: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been reported in Adobe Flash Player:
        lakehu of Tencent Security Center reported an unspecified
        memory corruption vulnerability (CVE-2009-1862).
        Mike Wroe
        reported an unspecified vulnerability, related to 'privilege
        escalation' (CVE-2009-1863).
        An anonymous researcher through
        iDefense reported an unspecified heap-based buffer overflow
        (CVE-2009-1864).
        Chen Chen of Venustech reported an
        unspecified 'NULL pointer vulnerability' (CVE-2009-1865).
        Chen
        Chen of Venustech reported an unspecified stack-based buffer overflow
        (CVE-2009-1866).
        Joran Benker reported that Adobe Flash Player
        facilitates 'clickjacking' attacks (CVE-2009-1867).
        Jun Mao of
        iDefense reported a heap-based buffer overflow, related to URL parsing
        (CVE-2009-1868).
        Roee Hay of IBM Rational Application Security
        reported an unspecified integer overflow (CVE-2009-1869).
        Gareth Heyes and Microsoft Vulnerability Research reported that the
        sandbox in Adobe Flash Player allows for information disclosure, when
        'SWFs are saved to the hard drive' (CVE-2009-1870).
      
    Impact :
    
        A remote attacker could entice a user to open a specially crafted PDF
        file or website containing Adobe Flash (SWF) contents, possibly
        resulting in the execution of arbitrary code with the privileges of the
        user running the application, or a Denial of Service (application
        crash). Furthermore, a remote attacker could trick a user into clicking
        a button on a dialog by supplying a specially crafted SWF file and
        disclose sensitive information by exploiting a sandbox issue.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/200908-04"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Adobe Flash Player users should upgrade to the latest version:
        # emerge --sync
        # emerge --ask --oneshot --verbose '>=www-plugins/adobe-flash-10.0.32.18'
        All Adobe Reader users should upgrade to the latest version:
        # emerge --sync
        # emerge --ask --oneshot --verbose '>=app-text/acroread-9.1.3'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:acroread");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:adobe-flash");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/08/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/08/10");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"app-text/acroread", unaffected:make_list("ge 9.1.3"), vulnerable:make_list("lt 9.1.3"))) flag++;
    if (qpkg_check(package:"www-plugins/adobe-flash", unaffected:make_list("ge 10.0.32.18"), vulnerable:make_list("lt 10.0.32.18"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Adobe products");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_FLASH-PLAYER-6386.NASL
    descriptionSpecially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code. (CVE-2009-1862 / CVE-2009-0901 / CVE-2009-2395 / CVE-2009-2493 / CVE-2009-1863 / CVE-2009-1864 / CVE-2009-1865 / CVE-2009-1866 / CVE-2009-1867 / CVE-2009-1868 / CVE-2009-1869 / CVE-2009-1870)
    last seen2020-06-01
    modified2020-06-02
    plugin id51731
    published2011-01-27
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/51731
    titleSuSE 10 Security Update : flash-player (ZYPP Patch Number 6386)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The text description of this plugin is (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(51731);
      script_version ("1.13");
      script_cvs_date("Date: 2019/10/25 13:36:36");
    
      script_cve_id("CVE-2009-0901", "CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870", "CVE-2009-2395", "CVE-2009-2493");
    
      script_name(english:"SuSE 10 Security Update : flash-player (ZYPP Patch Number 6386)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 10 host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Specially crafted Flash (SWF) files can cause a buffer overflow in
    flash-player. Attackers could potentially exploit that to execute
    arbitrary code. (CVE-2009-1862 / CVE-2009-0901 / CVE-2009-2395 /
    CVE-2009-2493 / CVE-2009-1863 / CVE-2009-1864 / CVE-2009-1865 /
    CVE-2009-1866 / CVE-2009-1867 / CVE-2009-1868 / CVE-2009-1869 /
    CVE-2009-1870)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-0901.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1862.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1863.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1864.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1865.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1866.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1867.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1868.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1869.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1870.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-2395.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-2493.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 6386.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 89, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2011/01/27");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
    if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
    if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");
    
    
    flag = 0;
    if (rpm_check(release:"SLED10", sp:2, reference:"flash-player-9.0.246.0-0.3")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else exit(0, "The host is not affected.");
    
  • NASL familyWindows
    NASL idADOBE_READER_913.NASL
    descriptionThe version of Adobe Reader 9 installed on the remote host is earlier than 9.1.3. Such versions are reportedly affected by a memory corruption vulnerability that could potentially lead to code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id40494
    published2009-08-05
    reporter(C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40494
    titleAdobe Reader < 9.1.3 Flash Handling Unspecified Arbitrary Code Execution (APSB09-10)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    include('compat.inc');
    
    
    if (description)
    {
      script_id(40494);
      script_version("1.20");
      script_cvs_date("Date: 2018/06/27 18:42:27");
    
      script_cve_id('CVE-2009-1862');
      script_bugtraq_id(35759);
    
      script_name(english:'Adobe Reader < 9.1.3 Flash Handling Unspecified Arbitrary Code Execution (APSB09-10)');
      script_summary(english:'Checks version of Adobe Reader');
    
      script_set_attribute(attribute:'synopsis', value:
    'The PDF file viewer on the remote Windows host is affected by a
    memory corruption vulnerability.');
      script_set_attribute(attribute:'description', value:
    'The version of Adobe Reader 9 installed on the remote host is earlier
    than 9.1.3.  Such versions are reportedly affected by a memory corruption
    vulnerability that could potentially lead to code execution.'  );
      script_set_attribute(
        attribute:'see_also',
        value:'http://www.adobe.com/support/security/bulletins/apsb09-10.html'
      );
      script_set_attribute(
        attribute:'solution',
        value:'Upgrade to Adobe Reader 9.1.3 or later.'
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(94);
    
      script_set_attribute(attribute:"plugin_publication_date", value: "2009/08/05");
      script_set_attribute(attribute:"patch_publication_date", value: "2009/07/30");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat_reader");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:'Windows');
    
      script_copyright(english:"(C) 2009-2018 Tenable Network Security, Inc.");
    
      script_dependencies('adobe_reader_installed.nasl');
      script_require_keys('SMB/Acroread/Version');
    
      exit(0);
    }
    
    
    include('global_settings.inc');
    
    
    info = NULL;
    vers = get_kb_list('SMB/Acroread/Version');
    if (isnull(vers)) exit(0, 'The "SMB/Acroread/Version" KB item is missing.');
    
    foreach version (vers)
    {
      ver = split(version, sep:'.', keep:FALSE);
      for (i=0; i<max_index(ver); i++)
        ver[i] = int(ver[i]);
    
      if  ( ver[0] == 9 && ( ver[1] < 1 || (ver[1] == 1 && ver[2] < 3) ) )
      {
        path = get_kb_item('SMB/Acroread/'+version+'/Path');
        if (isnull(path)) exit(1, 'The "SMB/Acroread/'+version+'/Path" KB item is missing.');
    
        verui = get_kb_item('SMB/Acroread/'+version+'/Version_UI');
        if (isnull(verui)) exit(1, 'The "SMB/Acroread/'+version+'/Version_UI" KB item is missing.');
    
        info += '  - ' + verui + ', under ' + path + '\n';
      }
    }
    
    if (isnull(info)) exit(0, 'The remote host is not affected.');
    
    if (report_verbosity > 0)
    {
      if (max_index(split(info)) > 1) s = "s of Adobe Reader are";
      else s = " of Adobe Reader is";
    
      report =
        '\nThe following vulnerable instance'+s+' installed on the'+
        '\nremote host :\n\n'+
        info;
      security_hole(port:get_kb_item("SMB/transport"), extra:report);
    }
    else security_hole(get_kb_item("SMB/transport"));
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_10_6_1.NASL
    descriptionThe remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.1. Mac OS X 10.6.1 contains security fixes for the following product : - Flash Player plug-in
    last seen2020-06-01
    modified2020-06-02
    plugin id40946
    published2009-09-11
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40946
    titleMac OS X 10.6.x < 10.6.1 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    if (!defined_func("bn_random")) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40946);
      script_version("1.18");
    
      script_cve_id("CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866",
                    "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870");
      script_bugtraq_id(35759, 36349);
    
      script_name(english:"Mac OS X 10.6.x < 10.6.1 Multiple Vulnerabilities");
      script_summary(english:"Check the version of Mac OS X");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "The remote host is missing a Mac OS X update that fixes various
    security issues."  );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is running a version of Mac OS X 10.6.x that is prior
    to 10.6.1. 
    
    Mac OS X 10.6.1 contains security fixes for the following product :
    
      - Flash Player plug-in"  );
      script_set_attribute(
        attribute:"see_also", 
        value:"http://support.apple.com/kb/HT3864"
      );
      script_set_attribute(
        attribute:"see_also", 
        value:"http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html"
      );
      script_set_attribute(
        attribute:"see_also", 
        value:"http://www.securityfocus.com/advisories/17867"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Upgrade to Mac OS X 10.6.1 or later."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 94, 119, 189, 200, 264);
      script_set_attribute(
        attribute:"patch_publication_date", 
        value:"2009/09/10"
      );
      script_set_attribute(
        attribute:"plugin_publication_date", 
        value:"2009/09/11"
      );
     script_cvs_date("Date: 2018/07/14  1:59:35");
      script_set_attribute(attribute:"plugin_type", value:"combined");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
      script_end_attributes();
     
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
     
      script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
     
      script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl");
    
     exit(0);
    }
    
    
    os = get_kb_item("Host/MacOSX/Version");
    if (!os) {
      os = get_kb_item("Host/OS");
      c = get_kb_item("Host/OS/Confidence");
      if ( isnull(os) || c <= 70 ) exit(0);
    }
    if (!os) exit(1, "The 'Host/OS' KB item is missing.");
    
    if (ereg(pattern:"Mac OS X 10\.6($|\.0)", string:os)) security_hole(0);
    else exit(0, "The host is not affected.");
    
  • NASL familyWindows
    NASL idFLASH_PLAYER_APSB09_10.NASL
    descriptionThe remote Windows host contains a version of Adobe Flash Player that is earlier than 9.0.246.0 / 10.0.32.18. Such versions are reportedly affected by multiple vulnerabilities : - A memory corruption vulnerability that could potentially lead to code execution. (CVE-2009-1862) - A vulnerability in the Microsoft Active Template Library (ATL) which could allow an attacker who successfully exploits the vulnerability to take control of the affected system. (CVE-2009-0901, CVE-2009-2395, CVE-2009-2493) - A privilege escalation vulnerability that could potentially lead to code execution. (CVE-2009-1863) - A heap overflow vulnerability that could potentially lead to code execution. (CVE-2009-1864) - A NULL pointer vulnerability that could potentially lead to code execution. (CVE-2009-1865) - A stack overflow vulnerability that could potentially lead to code execution. (CVE-2009-1866) - A clickjacking vulnerability that could allow an attacker to lure a web browser user into unknowingly clicking on a link or dialog. (CVE-2009-1867 - A URL parsing heap overflow vulnerability that could potentially lead to code execution. (CVE-2009-1868) - An integer overflow vulnerability that could potentially lead to code execution. (CVE-2009-1869) - A local sandbox vulnerability that could potentially lead to information disclosure when SWFs are saved to the hard drive. CVE-2009-1870)
    last seen2020-06-01
    modified2020-06-02
    plugin id40434
    published2009-07-30
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40434
    titleFlash Player < 9.0.246.0 / 10.0.32.18 Multiple Vulnerabilities (APSB09-10)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40434);
      script_version("1.21");
    
      script_cve_id(  'CVE-2009-1862', 'CVE-2009-0901', 'CVE-2009-2493',
                      'CVE-2009-1863', 'CVE-2009-1864', 'CVE-2009-1865', 'CVE-2009-1866',
                      'CVE-2009-1867', 'CVE-2009-1868', 'CVE-2009-1869', 'CVE-2009-1870');
      script_bugtraq_id(35759, 35832, 35846, 35900, 35901, 35902, 35903, 35904,
                        35905, 35906, 35907, 35908);
    
      script_name(english:"Flash Player < 9.0.246.0 / 10.0.32.18 Multiple Vulnerabilities (APSB09-10)");
      script_summary(english:"Checks version of Flash Player");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains a browser plugin that is affected by 
    multiple vulnerabilities."  );
    
      script_set_attribute( attribute:"description", value:
    "The remote Windows host contains a version of Adobe Flash Player that 
    is earlier than 9.0.246.0 / 10.0.32.18. Such versions are reportedly 
    affected by multiple vulnerabilities : 
    
      - A memory corruption vulnerability that could potentially
        lead to code execution. (CVE-2009-1862) 
    
      - A vulnerability in the Microsoft Active Template Library
        (ATL) which could allow an attacker who successfully
        exploits the vulnerability to take control of the
        affected system. (CVE-2009-0901, CVE-2009-2395,
        CVE-2009-2493) 
    
      - A privilege escalation vulnerability that could 
        potentially lead to code execution. (CVE-2009-1863)
    
      - A heap overflow vulnerability that could potentially
        lead to code execution. (CVE-2009-1864) 
    
      - A NULL pointer vulnerability that could potentially
        lead to code execution. (CVE-2009-1865) 
    
      - A stack overflow vulnerability that could potentially
        lead to code execution. (CVE-2009-1866) 
    
      - A clickjacking vulnerability that could allow an
        attacker to lure a web browser user into unknowingly
        clicking on a link or dialog. (CVE-2009-1867 
    
      - A URL parsing heap overflow vulnerability that could
        potentially lead to code execution. (CVE-2009-1868)
    
      - An integer overflow vulnerability that could potentially
        lead to code execution. (CVE-2009-1869) 
    
      - A local sandbox vulnerability that could potentially
        lead to information disclosure when SWFs are saved to
        the hard drive. CVE-2009-1870)"  );
    
      script_set_attribute(attribute:"see_also", value:
    "http://www.adobe.com/support/security/bulletins/apsb09-10.html"  );
    
      script_set_attribute( attribute:"solution", value:
    "Upgrade to version 10.0.32.18 or later. If you are unable to upgrade
    to version 10, upgrade to version 9.0.246.0 or later."  );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 94, 119, 189, 200, 264);
    
      script_set_attribute( attribute:'vuln_publication_date', value:'2009/07/28' );
      script_set_attribute( attribute:'patch_publication_date', value:'2009/07/30' );
      script_set_attribute( attribute:'plugin_publication_date', value:'2009/07/30' );
    
     script_cvs_date("Date: 2018/07/11 17:09:26");
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:flash_player");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
      script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
      script_dependencies("flash_player_installed.nasl");
      script_require_keys("SMB/Flash_Player/installed");
      exit(0);
    }
    
    #
    
    if (!get_kb_item("SMB/Flash_Player/installed")) exit(0);
    
    include ("global_settings.inc");
    
    # Identify vulnerable versions.
    info=NULL;
    
    foreach variant (make_list("Plugin", "ActiveX"))
    {
      vers = get_kb_list("SMB/Flash_Player/"+variant+"/Version/*");
      files = get_kb_list("SMB/Flash_Player/"+variant+"/File/*");
      if(!isnull(vers) && !isnull(files))
      {
        foreach key (keys(vers))
        {
          ver = vers[key];
          if (ver)
          {
            iver = split(ver, sep:'.',keep:FALSE);
            for(i=0;i<max_index(iver);i++)
              iver[i] = int(iver[i]);
            if (
              (
                iver[0] == 10 && iver[1] == 0 &&
                  (
                    iver[2] < 22 ||
                    (iver[2] == 22 && iver[3] <= 87)
                  )
              ) ||
              (iver[0] == 9 && iver[1] == 0 && iver[2] < 246) ||
              iver[0] < 9
            )
            {
              num = key - ("SMB/Flash_Player/"+variant+"/Version/");
              file = files["SMB/Flash_Player/"+variant+"/File/"+num];
              if (variant == "Plugin")
              {
                info += '  - Browser Plugin (for Firefox / Netscape / Opera) :\n';
              }
              else if (variant == "ActiveX")
              {
                info += '  - ActiveX control (for Internet Explorer) :\n';
              }
              info += '    ' + file + ', ' + ver + '\n';
            }
          }
        }
      }
    }
    
    if (info)
    {
      if (report_verbosity > 0)
      {
        # nb: each vulnerable instance adds 2 lines to 'info'.
        if (max_index(split(info)) > 2)
          inst = "s";
        else
          inst = "";
    
        report = string(
          "\n",
          "Nessus has identified the following vulnerable instance", inst, " of Flash\n",
          "Player installed on the remote host :\n",
          "\n",
          info
        );
        security_hole(port:get_kb_item("SMB/transport"), extra:report);
      }
      else security_hole(get_kb_item("SMB/transport"));
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_FLASH-PLAYER-090731.NASL
    descriptionSpecially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395, CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869, CVE-2009-1870).
    last seen2020-06-01
    modified2020-06-02
    plugin id40488
    published2009-08-05
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40488
    titleopenSUSE Security Update : flash-player (flash-player-1148)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update flash-player-1148.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40488);
      script_version("1.15");
      script_cvs_date("Date: 2019/10/25 13:36:34");
    
      script_cve_id("CVE-2009-0901", "CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870", "CVE-2009-2395", "CVE-2009-2493");
    
      script_name(english:"openSUSE Security Update : flash-player (flash-player-1148)");
      script_summary(english:"Check for the flash-player-1148 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Specially crafted Flash (SWF) files can cause a buffer overflow in
    flash-player. Attackers could potentially exploit that to execute
    arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395,
    CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865,
    CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869,
    CVE-2009-1870)."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=524508"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected flash-player package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 89, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:flash-player");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/08/05");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE11\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.0", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686)$") audit(AUDIT_ARCH_NOT, "i586 / i686", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE11.0", reference:"flash-player-9.0.246.0-0.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "flash-player");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_FLASH-PLAYER-090731.NASL
    descriptionSpecially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395, CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869, CVE-2009-1870).
    last seen2020-06-01
    modified2020-06-02
    plugin id40489
    published2009-08-05
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40489
    titleopenSUSE Security Update : flash-player (flash-player-1148)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update flash-player-1148.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40489);
      script_version("1.15");
      script_cvs_date("Date: 2019/10/25 13:36:34");
    
      script_cve_id("CVE-2009-0901", "CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870", "CVE-2009-2395", "CVE-2009-2493");
    
      script_name(english:"openSUSE Security Update : flash-player (flash-player-1148)");
      script_summary(english:"Check for the flash-player-1148 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Specially crafted Flash (SWF) files can cause a buffer overflow in
    flash-player. Attackers could potentially exploit that to execute
    arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395,
    CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865,
    CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869,
    CVE-2009-1870)."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=524508"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected flash-player package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 89, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:flash-player");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/08/05");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE11\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686)$") audit(AUDIT_ARCH_NOT, "i586 / i686", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE11.1", reference:"flash-player-10.0.32.18-0.1.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "flash-player");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2009-1188.NASL
    descriptionAn updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. Multiple security flaws were found in the way Flash Player displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, possibly, execute arbitrary code when the victim loaded a page containing the specially crafted SWF content. (CVE-2009-1862, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1868, CVE-2009-1869) A clickjacking flaw was discovered in Flash Player. A specially crafted SWF file could trick a user into unintentionally or mistakenly clicking a link or a dialog. (CVE-2009-1867) A flaw was found in the Flash Player local sandbox. A specially crafted SWF file could cause information disclosure when it was saved to the hard drive. (CVE-2009-1870) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 10.0.32.18.
    last seen2020-06-01
    modified2020-06-02
    plugin id63886
    published2013-01-24
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63886
    titleRHEL 5 : flash-plugin (RHSA-2009:1188)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2009:1188. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(63886);
      script_version("1.21");
      script_cvs_date("Date: 2019/10/25 13:36:14");
    
      script_cve_id("CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870");
      script_bugtraq_id(35759);
      script_xref(name:"RHSA", value:"2009:1188");
    
      script_name(english:"RHEL 5 : flash-plugin (RHSA-2009:1188)");
      script_summary(english:"Checks the rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An updated Adobe Flash Player package that fixes multiple security
    issues is now available for Red Hat Enterprise Linux 5 Supplementary.
    
    This update has been rated as having critical security impact by the
    Red Hat Security Response Team.
    
    The flash-plugin package contains a Mozilla Firefox compatible Adobe
    Flash Player web browser plug-in.
    
    Multiple security flaws were found in the way Flash Player displayed
    certain SWF content. An attacker could use these flaws to create a
    specially crafted SWF file that would cause flash-plugin to crash or,
    possibly, execute arbitrary code when the victim loaded a page
    containing the specially crafted SWF content. (CVE-2009-1862,
    CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866,
    CVE-2009-1868, CVE-2009-1869)
    
    A clickjacking flaw was discovered in Flash Player. A specially
    crafted SWF file could trick a user into unintentionally or mistakenly
    clicking a link or a dialog. (CVE-2009-1867)
    
    A flaw was found in the Flash Player local sandbox. A specially
    crafted SWF file could cause information disclosure when it was saved
    to the hard drive. (CVE-2009-1870)
    
    All users of Adobe Flash Player should install this updated package,
    which upgrades Flash Player to version 10.0.32.18."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1862"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1863"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1864"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1865"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1866"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1867"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1868"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1869"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1870"
      );
      # http://www.adobe.com/support/security/bulletins/apsb09-10.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.adobe.com/support/security/bulletins/apsb09-10.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2009:1188"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected flash-plugin package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:flash-plugin");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5.3");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2009/07/23");
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/24");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 5.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2009:1188";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL5", reference:"flash-plugin-10.0.32.18-2.el5")) flag++;
    
    
      if (flag)
      {
        flash_plugin_caveat = '\n' +
          'NOTE: This vulnerability check only applies to RedHat released\n' +
          'versions of the flash-plugin package. This check does not apply to\n' +
          'Adobe released versions of the flash-plugin package, which are\n' +
          'versioned similarly and cause collisions in detection.\n\n' +
    
          'If you are certain you are running the Adobe released package of\n' +
          'flash-plugin and are running a version of it equal or higher to the\n' +
          'RedHat version listed above then you can consider this a false\n' +
          'positive.\n';
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat() + flash_plugin_caveat
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "flash-plugin");
      }
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_FLASH-PLAYER-6387.NASL
    descriptionSpecially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395, CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869, CVE-2009-1870).
    last seen2020-06-01
    modified2020-06-02
    plugin id42001
    published2009-10-06
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/42001
    titleopenSUSE 10 Security Update : flash-player (flash-player-6387)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update flash-player-6387.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(42001);
      script_version ("1.12");
      script_cvs_date("Date: 2019/10/25 13:36:36");
    
      script_cve_id("CVE-2009-0901", "CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870", "CVE-2009-2395", "CVE-2009-2493");
    
      script_name(english:"openSUSE 10 Security Update : flash-player (flash-player-6387)");
      script_summary(english:"Check for the flash-player-6387 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Specially crafted Flash (SWF) files can cause a buffer overflow in
    flash-player. Attackers could potentially exploit that to execute
    arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395,
    CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865,
    CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869,
    CVE-2009-1870)."
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected flash-player package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 89, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:flash-player");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.3");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/10/06");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE10\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.3", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686)$") audit(AUDIT_ARCH_NOT, "i586 / i686", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE10.3", reference:"flash-player-9.0.246.0-0.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "flash-player");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2009-1189.NASL
    descriptionAn updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3 and 4 Extras. This update has been rated as having critical security impact by the Red Hat Security Response Team. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. Multiple security flaws were found in the way Flash Player displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, possibly, execute arbitrary code when the victim loaded a page containing the specially crafted SWF content. (CVE-2009-1862, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1868, CVE-2009-1869) A clickjacking flaw was discovered in Flash Player. A specially crafted SWF file could trick a user into unintentionally or mistakenly clicking a link or a dialog. (CVE-2009-1867) A flaw was found in the Flash Player local sandbox. A specially crafted SWF file could cause information disclosure when it was saved to the hard drive. (CVE-2009-1870) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 9.0.246.0.
    last seen2020-06-01
    modified2020-06-02
    plugin id63887
    published2013-01-24
    reporterThis script is Copyright (C) 2013-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/63887
    titleRHEL 3 / 4 : flash-plugin (RHSA-2009:1189)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2009:1189. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(63887);
      script_version("1.10");
      script_cvs_date("Date: 2019/10/25 13:36:14");
    
      script_cve_id("CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870");
      script_xref(name:"RHSA", value:"2009:1189");
    
      script_name(english:"RHEL 3 / 4 : flash-plugin (RHSA-2009:1189)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An updated Adobe Flash Player package that fixes multiple security
    issues is now available for Red Hat Enterprise Linux 3 and 4 Extras.
    
    This update has been rated as having critical security impact by the
    Red Hat Security Response Team.
    
    The flash-plugin package contains a Mozilla Firefox compatible Adobe
    Flash Player web browser plug-in.
    
    Multiple security flaws were found in the way Flash Player displayed
    certain SWF content. An attacker could use these flaws to create a
    specially crafted SWF file that would cause flash-plugin to crash or,
    possibly, execute arbitrary code when the victim loaded a page
    containing the specially crafted SWF content. (CVE-2009-1862,
    CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866,
    CVE-2009-1868, CVE-2009-1869)
    
    A clickjacking flaw was discovered in Flash Player. A
    specially crafted SWF file could trick a user into unintentionally or
    mistakenly clicking a link or a dialog. (CVE-2009-1867)
    
    A flaw was found in the Flash Player local sandbox. A
    specially crafted SWF file could cause information disclosure when it
    was saved to the hard drive. (CVE-2009-1870)
    
    All users of Adobe Flash Player should install this updated package,
    which upgrades Flash Player to version 9.0.246.0."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1862.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1863.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1864.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1865.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1866.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1867.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1868.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1869.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1870.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.adobe.com/support/security/bulletins/apsb09-10.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://rhn.redhat.com/errata/RHSA-2009-1189.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected flash-plugin package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:flash-plugin");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:3");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4.8");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/24");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2019 Tenable Network Security, Inc.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    flag = 0;
    if (rpm_check(release:"RHEL3", cpu:"i386", reference:"flash-plugin-9.0.246.0-2.el3.with.oss")) flag++;
    
    if (rpm_check(release:"RHEL4", cpu:"i386", reference:"flash-plugin-9.0.246.0-2.el4")) flag++;
    
    if (rpm_check(release:"RHEL4", sp:"8", cpu:"i386", reference:"flash-plugin-9.0.246.0-2.el4")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    

Redhat

rpms
  • flash-plugin-0:10.0.32.18-2.el5
  • flash-plugin-0:9.0.246.0-2.el3.with.oss
  • flash-plugin-0:9.0.246.0-2.el4

Saint

bid35759
descriptionAdobe Flash Player authplay.dll vulnerability
idmisc_flash
osvdb56282
titleflash_authplay
typeclient

References