Vulnerabilities > CVE-2009-1866 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Adobe Air, Flash Player and Flex

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
adobe
CWE-119
critical
nessus

Summary

Stack-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.

Vulnerable Configurations

Part Description Count
Application
Adobe
86

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_FLASH-PLAYER-090731.NASL
    descriptionSpecially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code. (CVE-2009-1862 / CVE-2009-0901 / CVE-2009-2395 / CVE-2009-2493 / CVE-2009-1863 / CVE-2009-1864 / CVE-2009-1865 / CVE-2009-1866 / CVE-2009-1867 / CVE-2009-1868 / CVE-2009-1869 / CVE-2009-1870)
    last seen2020-06-01
    modified2020-06-02
    plugin id41392
    published2009-09-24
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/41392
    titleSuSE 11 Security Update : flash-player (SAT Patch Number 1149)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from SuSE 11 update information. The text itself is
    # copyright (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(41392);
      script_version("1.18");
      script_cvs_date("Date: 2019/10/25 13:36:35");
    
      script_cve_id("CVE-2009-0901", "CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870", "CVE-2009-2395", "CVE-2009-2493");
    
      script_name(english:"SuSE 11 Security Update : flash-player (SAT Patch Number 1149)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 11 host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Specially crafted Flash (SWF) files can cause a buffer overflow in
    flash-player. Attackers could potentially exploit that to execute
    arbitrary code. (CVE-2009-1862 / CVE-2009-0901 / CVE-2009-2395 /
    CVE-2009-2493 / CVE-2009-1863 / CVE-2009-1864 / CVE-2009-1865 /
    CVE-2009-1866 / CVE-2009-1867 / CVE-2009-1868 / CVE-2009-1869 /
    CVE-2009-1870)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=524508"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-0901.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1862.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1863.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1864.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1865.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1866.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1867.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1868.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1869.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1870.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-2395.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-2493.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply SAT patch number 1149.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 89, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:flash-player");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/09/24");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);
    
    pl = get_kb_item("Host/SuSE/patchlevel");
    if (pl) audit(AUDIT_OS_NOT, "SuSE 11.0");
    
    
    flag = 0;
    if (rpm_check(release:"SLED11", sp:0, cpu:"i586", reference:"flash-player-10.0.32.18-0.1.1")) flag++;
    if (rpm_check(release:"SLED11", sp:0, cpu:"x86_64", reference:"")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyWindows
    NASL idADOBE_AIR_APSB09-10.NASL
    descriptionThe remote Windows host contains a version of Adobe AIR Player that is earlier than 1.5.2. Such versions are reportedly affected by multiple vulnerabilities : - A memory corruption vulnerability that could potentially lead to code execution. (CVE-2009-1862) - A privilege escalation vulnerability that could potentially lead to code execution. (CVE-2009-1863) - A heap overflow vulnerability that could potentially lead to code execution. (CVE-2009-1864) - A NULL pointer vulnerability that could potentially lead to code execution. (CVE-2009-1865) - A stack overflow vulnerability that could potentially lead to code execution. (CVE-2009-1866) - A clickjacking vulnerability that could allow an attacker to lure a web browser user into unknowingly clicking on a link or dialog. (CVE-2009-1867 - A URL parsing heap overflow vulnerability that could potentially lead to code execution. (CVE-2009-1868) - An integer overflow vulnerability that could potentially lead to code execution. (CVE-2009-1869) - A local sandbox vulnerability that could potentially lead to information disclosure when SWFs are saved to the hard drive. CVE-2009-1870)
    last seen2020-06-01
    modified2020-06-02
    plugin id40447
    published2009-07-31
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40447
    titleAdobe AIR < 1.5.2 Multiple Vulnerabilities (APSB09-10)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40447);
      script_version("1.19");
      script_cvs_date("Date: 2018/06/27 18:42:26");
    
      script_cve_id('CVE-2009-1862', 'CVE-2009-1863', 'CVE-2009-1864', 'CVE-2009-1865', 'CVE-2009-1866',
                    'CVE-2009-1867', 'CVE-2009-1868', 'CVE-2009-1869', 'CVE-2009-1870');
      script_bugtraq_id(35759, 35900, 35901, 35902, 35903, 35904, 35905, 35906, 35907, 35908
        # 35890                             it's been retired.
      );
    
      script_name(english:"Adobe AIR < 1.5.2 Multiple Vulnerabilities (APSB09-10)");
      script_summary(english:"Checks version of Adobe AIR");
    
       script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains a version of Adobe AIR that is affected by 
    multiple vulnerabilities.");
    
      script_set_attribute(attribute:"description", value:
    "The remote Windows host contains a version of Adobe AIR Player that 
    is earlier than 1.5.2. Such versions are reportedly affected by
    multiple vulnerabilities : 
    
      - A memory corruption vulnerability that could potentially
        lead to code execution. (CVE-2009-1862) 
    
      - A privilege escalation vulnerability that could
        potentially lead to code execution. (CVE-2009-1863) 
    
      - A heap overflow vulnerability that could potentially
        lead to code execution. (CVE-2009-1864) 
    
      - A NULL pointer vulnerability that could potentially
        lead to code execution. (CVE-2009-1865) 
    
      - A stack overflow vulnerability that could potentially
        lead to code execution. (CVE-2009-1866) 
    
      - A clickjacking vulnerability that could allow an
        attacker to lure a web browser user into unknowingly
        clicking on a link or dialog. (CVE-2009-1867
    
      - A URL parsing heap overflow vulnerability that could
        potentially lead to code execution. (CVE-2009-1868)
    
      - An integer overflow vulnerability that could potentially
        lead to code execution. (CVE-2009-1869) 
    
      - A local sandbox vulnerability that could potentially
        lead to information disclosure when SWFs are saved to
        the hard drive. CVE-2009-1870)");
    
      script_set_attribute(attribute:"see_also", value:"http://www.adobe.com/support/security/bulletins/apsb09-10.html");
      script_set_attribute(attribute:"solution", value:"Upgrade to Adobe AIR version 1.5.2 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:'vuln_publication_date', value:'2009/07/28');
      script_set_attribute(attribute:'patch_publication_date', value:'2009/07/30');
      script_set_attribute(attribute:'plugin_publication_date', value:'2009/07/31');
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:air");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
    
      script_dependencies("adobe_air_installed.nasl");
      script_require_keys("SMB/Adobe_AIR/Version");
    
      exit(0);
    }
    
    
    include("global_settings.inc");
    
    
    version_ui = get_kb_item("SMB/Adobe_AIR/Version_UI");
    version = get_kb_item("SMB/Adobe_AIR/Version");
    if (isnull(version)) exit(1, "SMB/Adobe_AIR/Version KB item is missing.");
    
    ver = split(version, sep:'.', keep:FALSE);
    for (i=0; i<max_index(ver); i++)
      ver[i] = int(ver[i]);
    
    if (
      ver[0] < 1 ||
      (
        ver[0] == 1 &&
        (
          ver[1] < 5 ||
          (ver[1] == 5 && ver[2] <= 1)
        )
      )
    )
    {
      if (report_verbosity > 0 && version_ui)
      {
        report = string(
          "\n",
          "Adobe AIR ", version_ui, " is currently installed on the remote host.\n"
        );
        security_hole(port:get_kb_item("SMB/transport"), extra:report);
      }
      else security_hole(get_kb_item("SMB/transport"));
      exit(0);
    }
    else exit(0, "The host is not affected.");
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2009-005.NASL
    descriptionThe remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-005 applied. This security update contains fixes for the following products : - Alias Manager - CarbonCore - ClamAV - ColorSync - CoreGraphics - CUPS - Flash Player plug-in - ImageIO - Launch Services - MySQL - PHP - SMB - Wiki Server
    last seen2020-06-01
    modified2020-06-02
    plugin id40945
    published2009-09-11
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40945
    titleMac OS X Multiple Vulnerabilities (Security Update 2009-005)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    if (!defined_func("bn_random")) exit(0);
    if (NASL_LEVEL < 3004) exit(0);
    
    include("compat.inc");
    
    
    if (description)
    {
      script_id(40945);
      script_version("1.21");
      script_cvs_date("Date: 2018/07/14  1:59:35");
    
      script_cve_id("CVE-2008-2079", "CVE-2008-5498", "CVE-2008-6680", "CVE-2009-0590", "CVE-2009-0591",
                    "CVE-2009-0789", "CVE-2009-0949", "CVE-2009-1241", "CVE-2009-1270", "CVE-2009-1271",
                    "CVE-2009-1272", "CVE-2009-1371", "CVE-2009-1372", "CVE-2009-1862", "CVE-2009-1863",
                    "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868",
                    "CVE-2009-1869", "CVE-2009-1870", "CVE-2009-2468", "CVE-2009-2800", "CVE-2009-2803",
                    "CVE-2009-2804", "CVE-2009-2805", "CVE-2009-2807", "CVE-2009-2809", "CVE-2009-2811",
                    "CVE-2009-2812", "CVE-2009-2813", "CVE-2009-2814");
      script_bugtraq_id(
        29106,
        33002,
        34256,
        34357,
        35759,
        36350,
        36354,
        36355,
        36357,
        36358,
        36359,
        36360,
        36361,
        36363,
        36364
      );
    
      script_name(english:"Mac OS X Multiple Vulnerabilities (Security Update 2009-005)");
      script_summary(english:"Check for the presence of Security Update 2009-005");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote host is missing a Mac OS X update that fixes various
    security issues."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is running a version of Mac OS X 10.5 or 10.4 that
    does not have Security Update 2009-005 applied.
    
    This security update contains fixes for the following products :
    
      - Alias Manager
      - CarbonCore
      - ClamAV
      - ColorSync
      - CoreGraphics
      - CUPS
      - Flash Player plug-in
      - ImageIO
      - Launch Services
      - MySQL
      - PHP
      - SMB
      - Wiki Server"
      );
      script_set_attribute(
        attribute:"see_also", 
        value:"http://support.apple.com/kb/HT3865"
      );
      script_set_attribute(
        attribute:"see_also", 
        value:"http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html"
      );
      script_set_attribute(
        attribute:"see_also", 
        value:"http://www.securityfocus.com/advisories/17867"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Install Security Update 2009-005 or later."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(20, 59, 79, 94, 119, 189, 200, 264, 287, 399);
      script_set_attribute(attribute:"patch_publication_date", value:"2009/09/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/09/11");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
      script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/MacOSX/packages", "Host/uname");
      exit(0);
    }
    
    #
    
    uname = get_kb_item("Host/uname");
    if (!uname) exit(1, "The 'Host/uname' KB item is missing.");
    
    if (egrep(pattern:"Darwin.* (8\.[0-9]\.|8\.1[01]\.)", string:uname))
    {
      packages = get_kb_item("Host/MacOSX/packages");
      if (!packages) exit(1, "The 'Host/MacOSX/packages' KB item is missing.");
    
      if (egrep(pattern:"^SecUpd(Srvr)?(2009-00[5-9]|20[1-9][0-9]-)", string:packages))
        exit(0, "The host has Security Update 2009-005 or later installed and therefore is not affected.");
      else
        security_hole(0);
    }
    else if (egrep(pattern:"Darwin.* (9\.[0-8]\.)", string:uname))
    {
      packages = get_kb_item("Host/MacOSX/packages/boms");
      if (!packages) exit(1, "The 'Host/MacOSX/packages/boms' KB item is missing.");
    
      if (egrep(pattern:"^com\.apple\.pkg\.update\.security\.(2009\.00[5-9]|20[1-9][0-9]\.[0-9]+)\.bom", string:packages))
        exit(0, "The host has Security Update 2009-005 or later installed and therefore is not affected.");
      else
        security_hole(0);
    }
    else exit(0, "The host is not affected.");
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200908-04.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200908-04 (Adobe products: Multiple vulnerabilities) Multiple vulnerabilities have been reported in Adobe Flash Player: lakehu of Tencent Security Center reported an unspecified memory corruption vulnerability (CVE-2009-1862). Mike Wroe reported an unspecified vulnerability, related to
    last seen2020-06-01
    modified2020-06-02
    plugin id40520
    published2009-08-10
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40520
    titleGLSA-200908-04 : Adobe products: Multiple vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 200908-04.
    #
    # The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40520);
      script_version("1.24");
      script_cvs_date("Date: 2019/08/02 13:32:45");
    
      script_cve_id("CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870");
      script_xref(name:"GLSA", value:"200908-04");
    
      script_name(english:"GLSA-200908-04 : Adobe products: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-200908-04
    (Adobe products: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been reported in Adobe Flash Player:
        lakehu of Tencent Security Center reported an unspecified
        memory corruption vulnerability (CVE-2009-1862).
        Mike Wroe
        reported an unspecified vulnerability, related to 'privilege
        escalation' (CVE-2009-1863).
        An anonymous researcher through
        iDefense reported an unspecified heap-based buffer overflow
        (CVE-2009-1864).
        Chen Chen of Venustech reported an
        unspecified 'NULL pointer vulnerability' (CVE-2009-1865).
        Chen
        Chen of Venustech reported an unspecified stack-based buffer overflow
        (CVE-2009-1866).
        Joran Benker reported that Adobe Flash Player
        facilitates 'clickjacking' attacks (CVE-2009-1867).
        Jun Mao of
        iDefense reported a heap-based buffer overflow, related to URL parsing
        (CVE-2009-1868).
        Roee Hay of IBM Rational Application Security
        reported an unspecified integer overflow (CVE-2009-1869).
        Gareth Heyes and Microsoft Vulnerability Research reported that the
        sandbox in Adobe Flash Player allows for information disclosure, when
        'SWFs are saved to the hard drive' (CVE-2009-1870).
      
    Impact :
    
        A remote attacker could entice a user to open a specially crafted PDF
        file or website containing Adobe Flash (SWF) contents, possibly
        resulting in the execution of arbitrary code with the privileges of the
        user running the application, or a Denial of Service (application
        crash). Furthermore, a remote attacker could trick a user into clicking
        a button on a dialog by supplying a specially crafted SWF file and
        disclose sensitive information by exploiting a sandbox issue.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/200908-04"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Adobe Flash Player users should upgrade to the latest version:
        # emerge --sync
        # emerge --ask --oneshot --verbose '>=www-plugins/adobe-flash-10.0.32.18'
        All Adobe Reader users should upgrade to the latest version:
        # emerge --sync
        # emerge --ask --oneshot --verbose '>=app-text/acroread-9.1.3'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:acroread");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:adobe-flash");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/08/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/08/10");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"app-text/acroread", unaffected:make_list("ge 9.1.3"), vulnerable:make_list("lt 9.1.3"))) flag++;
    if (qpkg_check(package:"www-plugins/adobe-flash", unaffected:make_list("ge 10.0.32.18"), vulnerable:make_list("lt 10.0.32.18"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Adobe products");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_FLASH-PLAYER-6386.NASL
    descriptionSpecially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code. (CVE-2009-1862 / CVE-2009-0901 / CVE-2009-2395 / CVE-2009-2493 / CVE-2009-1863 / CVE-2009-1864 / CVE-2009-1865 / CVE-2009-1866 / CVE-2009-1867 / CVE-2009-1868 / CVE-2009-1869 / CVE-2009-1870)
    last seen2020-06-01
    modified2020-06-02
    plugin id51731
    published2011-01-27
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/51731
    titleSuSE 10 Security Update : flash-player (ZYPP Patch Number 6386)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The text description of this plugin is (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(51731);
      script_version ("1.13");
      script_cvs_date("Date: 2019/10/25 13:36:36");
    
      script_cve_id("CVE-2009-0901", "CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870", "CVE-2009-2395", "CVE-2009-2493");
    
      script_name(english:"SuSE 10 Security Update : flash-player (ZYPP Patch Number 6386)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 10 host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Specially crafted Flash (SWF) files can cause a buffer overflow in
    flash-player. Attackers could potentially exploit that to execute
    arbitrary code. (CVE-2009-1862 / CVE-2009-0901 / CVE-2009-2395 /
    CVE-2009-2493 / CVE-2009-1863 / CVE-2009-1864 / CVE-2009-1865 /
    CVE-2009-1866 / CVE-2009-1867 / CVE-2009-1868 / CVE-2009-1869 /
    CVE-2009-1870)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-0901.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1862.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1863.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1864.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1865.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1866.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1867.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1868.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1869.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-1870.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-2395.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2009-2493.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 6386.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 89, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2011/01/27");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2011-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
    if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
    if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");
    
    
    flag = 0;
    if (rpm_check(release:"SLED10", sp:2, reference:"flash-player-9.0.246.0-0.3")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else exit(0, "The host is not affected.");
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_10_6_1.NASL
    descriptionThe remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.1. Mac OS X 10.6.1 contains security fixes for the following product : - Flash Player plug-in
    last seen2020-06-01
    modified2020-06-02
    plugin id40946
    published2009-09-11
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40946
    titleMac OS X 10.6.x < 10.6.1 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    if (!defined_func("bn_random")) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40946);
      script_version("1.18");
    
      script_cve_id("CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866",
                    "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870");
      script_bugtraq_id(35759, 36349);
    
      script_name(english:"Mac OS X 10.6.x < 10.6.1 Multiple Vulnerabilities");
      script_summary(english:"Check the version of Mac OS X");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "The remote host is missing a Mac OS X update that fixes various
    security issues."  );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is running a version of Mac OS X 10.6.x that is prior
    to 10.6.1. 
    
    Mac OS X 10.6.1 contains security fixes for the following product :
    
      - Flash Player plug-in"  );
      script_set_attribute(
        attribute:"see_also", 
        value:"http://support.apple.com/kb/HT3864"
      );
      script_set_attribute(
        attribute:"see_also", 
        value:"http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html"
      );
      script_set_attribute(
        attribute:"see_also", 
        value:"http://www.securityfocus.com/advisories/17867"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Upgrade to Mac OS X 10.6.1 or later."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 94, 119, 189, 200, 264);
      script_set_attribute(
        attribute:"patch_publication_date", 
        value:"2009/09/10"
      );
      script_set_attribute(
        attribute:"plugin_publication_date", 
        value:"2009/09/11"
      );
     script_cvs_date("Date: 2018/07/14  1:59:35");
      script_set_attribute(attribute:"plugin_type", value:"combined");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
      script_end_attributes();
     
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
     
      script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
     
      script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl");
    
     exit(0);
    }
    
    
    os = get_kb_item("Host/MacOSX/Version");
    if (!os) {
      os = get_kb_item("Host/OS");
      c = get_kb_item("Host/OS/Confidence");
      if ( isnull(os) || c <= 70 ) exit(0);
    }
    if (!os) exit(1, "The 'Host/OS' KB item is missing.");
    
    if (ereg(pattern:"Mac OS X 10\.6($|\.0)", string:os)) security_hole(0);
    else exit(0, "The host is not affected.");
    
  • NASL familyWindows
    NASL idFLASH_PLAYER_APSB09_10.NASL
    descriptionThe remote Windows host contains a version of Adobe Flash Player that is earlier than 9.0.246.0 / 10.0.32.18. Such versions are reportedly affected by multiple vulnerabilities : - A memory corruption vulnerability that could potentially lead to code execution. (CVE-2009-1862) - A vulnerability in the Microsoft Active Template Library (ATL) which could allow an attacker who successfully exploits the vulnerability to take control of the affected system. (CVE-2009-0901, CVE-2009-2395, CVE-2009-2493) - A privilege escalation vulnerability that could potentially lead to code execution. (CVE-2009-1863) - A heap overflow vulnerability that could potentially lead to code execution. (CVE-2009-1864) - A NULL pointer vulnerability that could potentially lead to code execution. (CVE-2009-1865) - A stack overflow vulnerability that could potentially lead to code execution. (CVE-2009-1866) - A clickjacking vulnerability that could allow an attacker to lure a web browser user into unknowingly clicking on a link or dialog. (CVE-2009-1867 - A URL parsing heap overflow vulnerability that could potentially lead to code execution. (CVE-2009-1868) - An integer overflow vulnerability that could potentially lead to code execution. (CVE-2009-1869) - A local sandbox vulnerability that could potentially lead to information disclosure when SWFs are saved to the hard drive. CVE-2009-1870)
    last seen2020-06-01
    modified2020-06-02
    plugin id40434
    published2009-07-30
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40434
    titleFlash Player < 9.0.246.0 / 10.0.32.18 Multiple Vulnerabilities (APSB09-10)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40434);
      script_version("1.21");
    
      script_cve_id(  'CVE-2009-1862', 'CVE-2009-0901', 'CVE-2009-2493',
                      'CVE-2009-1863', 'CVE-2009-1864', 'CVE-2009-1865', 'CVE-2009-1866',
                      'CVE-2009-1867', 'CVE-2009-1868', 'CVE-2009-1869', 'CVE-2009-1870');
      script_bugtraq_id(35759, 35832, 35846, 35900, 35901, 35902, 35903, 35904,
                        35905, 35906, 35907, 35908);
    
      script_name(english:"Flash Player < 9.0.246.0 / 10.0.32.18 Multiple Vulnerabilities (APSB09-10)");
      script_summary(english:"Checks version of Flash Player");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains a browser plugin that is affected by 
    multiple vulnerabilities."  );
    
      script_set_attribute( attribute:"description", value:
    "The remote Windows host contains a version of Adobe Flash Player that 
    is earlier than 9.0.246.0 / 10.0.32.18. Such versions are reportedly 
    affected by multiple vulnerabilities : 
    
      - A memory corruption vulnerability that could potentially
        lead to code execution. (CVE-2009-1862) 
    
      - A vulnerability in the Microsoft Active Template Library
        (ATL) which could allow an attacker who successfully
        exploits the vulnerability to take control of the
        affected system. (CVE-2009-0901, CVE-2009-2395,
        CVE-2009-2493) 
    
      - A privilege escalation vulnerability that could 
        potentially lead to code execution. (CVE-2009-1863)
    
      - A heap overflow vulnerability that could potentially
        lead to code execution. (CVE-2009-1864) 
    
      - A NULL pointer vulnerability that could potentially
        lead to code execution. (CVE-2009-1865) 
    
      - A stack overflow vulnerability that could potentially
        lead to code execution. (CVE-2009-1866) 
    
      - A clickjacking vulnerability that could allow an
        attacker to lure a web browser user into unknowingly
        clicking on a link or dialog. (CVE-2009-1867 
    
      - A URL parsing heap overflow vulnerability that could
        potentially lead to code execution. (CVE-2009-1868)
    
      - An integer overflow vulnerability that could potentially
        lead to code execution. (CVE-2009-1869) 
    
      - A local sandbox vulnerability that could potentially
        lead to information disclosure when SWFs are saved to
        the hard drive. CVE-2009-1870)"  );
    
      script_set_attribute(attribute:"see_also", value:
    "http://www.adobe.com/support/security/bulletins/apsb09-10.html"  );
    
      script_set_attribute( attribute:"solution", value:
    "Upgrade to version 10.0.32.18 or later. If you are unable to upgrade
    to version 10, upgrade to version 9.0.246.0 or later."  );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 94, 119, 189, 200, 264);
    
      script_set_attribute( attribute:'vuln_publication_date', value:'2009/07/28' );
      script_set_attribute( attribute:'patch_publication_date', value:'2009/07/30' );
      script_set_attribute( attribute:'plugin_publication_date', value:'2009/07/30' );
    
     script_cvs_date("Date: 2018/07/11 17:09:26");
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:flash_player");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
      script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
      script_dependencies("flash_player_installed.nasl");
      script_require_keys("SMB/Flash_Player/installed");
      exit(0);
    }
    
    #
    
    if (!get_kb_item("SMB/Flash_Player/installed")) exit(0);
    
    include ("global_settings.inc");
    
    # Identify vulnerable versions.
    info=NULL;
    
    foreach variant (make_list("Plugin", "ActiveX"))
    {
      vers = get_kb_list("SMB/Flash_Player/"+variant+"/Version/*");
      files = get_kb_list("SMB/Flash_Player/"+variant+"/File/*");
      if(!isnull(vers) && !isnull(files))
      {
        foreach key (keys(vers))
        {
          ver = vers[key];
          if (ver)
          {
            iver = split(ver, sep:'.',keep:FALSE);
            for(i=0;i<max_index(iver);i++)
              iver[i] = int(iver[i]);
            if (
              (
                iver[0] == 10 && iver[1] == 0 &&
                  (
                    iver[2] < 22 ||
                    (iver[2] == 22 && iver[3] <= 87)
                  )
              ) ||
              (iver[0] == 9 && iver[1] == 0 && iver[2] < 246) ||
              iver[0] < 9
            )
            {
              num = key - ("SMB/Flash_Player/"+variant+"/Version/");
              file = files["SMB/Flash_Player/"+variant+"/File/"+num];
              if (variant == "Plugin")
              {
                info += '  - Browser Plugin (for Firefox / Netscape / Opera) :\n';
              }
              else if (variant == "ActiveX")
              {
                info += '  - ActiveX control (for Internet Explorer) :\n';
              }
              info += '    ' + file + ', ' + ver + '\n';
            }
          }
        }
      }
    }
    
    if (info)
    {
      if (report_verbosity > 0)
      {
        # nb: each vulnerable instance adds 2 lines to 'info'.
        if (max_index(split(info)) > 2)
          inst = "s";
        else
          inst = "";
    
        report = string(
          "\n",
          "Nessus has identified the following vulnerable instance", inst, " of Flash\n",
          "Player installed on the remote host :\n",
          "\n",
          info
        );
        security_hole(port:get_kb_item("SMB/transport"), extra:report);
      }
      else security_hole(get_kb_item("SMB/transport"));
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_0_FLASH-PLAYER-090731.NASL
    descriptionSpecially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395, CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869, CVE-2009-1870).
    last seen2020-06-01
    modified2020-06-02
    plugin id40488
    published2009-08-05
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40488
    titleopenSUSE Security Update : flash-player (flash-player-1148)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update flash-player-1148.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40488);
      script_version("1.15");
      script_cvs_date("Date: 2019/10/25 13:36:34");
    
      script_cve_id("CVE-2009-0901", "CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870", "CVE-2009-2395", "CVE-2009-2493");
    
      script_name(english:"openSUSE Security Update : flash-player (flash-player-1148)");
      script_summary(english:"Check for the flash-player-1148 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Specially crafted Flash (SWF) files can cause a buffer overflow in
    flash-player. Attackers could potentially exploit that to execute
    arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395,
    CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865,
    CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869,
    CVE-2009-1870)."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=524508"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected flash-player package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 89, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:flash-player");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/08/05");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE11\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.0", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686)$") audit(AUDIT_ARCH_NOT, "i586 / i686", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE11.0", reference:"flash-player-9.0.246.0-0.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "flash-player");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_1_FLASH-PLAYER-090731.NASL
    descriptionSpecially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395, CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869, CVE-2009-1870).
    last seen2020-06-01
    modified2020-06-02
    plugin id40489
    published2009-08-05
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40489
    titleopenSUSE Security Update : flash-player (flash-player-1148)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update flash-player-1148.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40489);
      script_version("1.15");
      script_cvs_date("Date: 2019/10/25 13:36:34");
    
      script_cve_id("CVE-2009-0901", "CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870", "CVE-2009-2395", "CVE-2009-2493");
    
      script_name(english:"openSUSE Security Update : flash-player (flash-player-1148)");
      script_summary(english:"Check for the flash-player-1148 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Specially crafted Flash (SWF) files can cause a buffer overflow in
    flash-player. Attackers could potentially exploit that to execute
    arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395,
    CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865,
    CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869,
    CVE-2009-1870)."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=524508"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected flash-player package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 89, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:flash-player");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/08/05");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE11\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686)$") audit(AUDIT_ARCH_NOT, "i586 / i686", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE11.1", reference:"flash-player-10.0.32.18-0.1.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "flash-player");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2009-1188.NASL
    descriptionAn updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. Multiple security flaws were found in the way Flash Player displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, possibly, execute arbitrary code when the victim loaded a page containing the specially crafted SWF content. (CVE-2009-1862, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1868, CVE-2009-1869) A clickjacking flaw was discovered in Flash Player. A specially crafted SWF file could trick a user into unintentionally or mistakenly clicking a link or a dialog. (CVE-2009-1867) A flaw was found in the Flash Player local sandbox. A specially crafted SWF file could cause information disclosure when it was saved to the hard drive. (CVE-2009-1870) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 10.0.32.18.
    last seen2020-06-01
    modified2020-06-02
    plugin id63886
    published2013-01-24
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63886
    titleRHEL 5 : flash-plugin (RHSA-2009:1188)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2009:1188. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(63886);
      script_version("1.21");
      script_cvs_date("Date: 2019/10/25 13:36:14");
    
      script_cve_id("CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870");
      script_bugtraq_id(35759);
      script_xref(name:"RHSA", value:"2009:1188");
    
      script_name(english:"RHEL 5 : flash-plugin (RHSA-2009:1188)");
      script_summary(english:"Checks the rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An updated Adobe Flash Player package that fixes multiple security
    issues is now available for Red Hat Enterprise Linux 5 Supplementary.
    
    This update has been rated as having critical security impact by the
    Red Hat Security Response Team.
    
    The flash-plugin package contains a Mozilla Firefox compatible Adobe
    Flash Player web browser plug-in.
    
    Multiple security flaws were found in the way Flash Player displayed
    certain SWF content. An attacker could use these flaws to create a
    specially crafted SWF file that would cause flash-plugin to crash or,
    possibly, execute arbitrary code when the victim loaded a page
    containing the specially crafted SWF content. (CVE-2009-1862,
    CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866,
    CVE-2009-1868, CVE-2009-1869)
    
    A clickjacking flaw was discovered in Flash Player. A specially
    crafted SWF file could trick a user into unintentionally or mistakenly
    clicking a link or a dialog. (CVE-2009-1867)
    
    A flaw was found in the Flash Player local sandbox. A specially
    crafted SWF file could cause information disclosure when it was saved
    to the hard drive. (CVE-2009-1870)
    
    All users of Adobe Flash Player should install this updated package,
    which upgrades Flash Player to version 10.0.32.18."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1862"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1863"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1864"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1865"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1866"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1867"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1868"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1869"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2009-1870"
      );
      # http://www.adobe.com/support/security/bulletins/apsb09-10.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.adobe.com/support/security/bulletins/apsb09-10.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2009:1188"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected flash-plugin package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:flash-plugin");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5.3");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2009/07/23");
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/24");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 5.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2009:1188";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL5", reference:"flash-plugin-10.0.32.18-2.el5")) flag++;
    
    
      if (flag)
      {
        flash_plugin_caveat = '\n' +
          'NOTE: This vulnerability check only applies to RedHat released\n' +
          'versions of the flash-plugin package. This check does not apply to\n' +
          'Adobe released versions of the flash-plugin package, which are\n' +
          'versioned similarly and cause collisions in detection.\n\n' +
    
          'If you are certain you are running the Adobe released package of\n' +
          'flash-plugin and are running a version of it equal or higher to the\n' +
          'RedHat version listed above then you can consider this a false\n' +
          'positive.\n';
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat() + flash_plugin_caveat
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "flash-plugin");
      }
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_FLASH-PLAYER-6387.NASL
    descriptionSpecially crafted Flash (SWF) files can cause a buffer overflow in flash-player. Attackers could potentially exploit that to execute arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395, CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869, CVE-2009-1870).
    last seen2020-06-01
    modified2020-06-02
    plugin id42001
    published2009-10-06
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/42001
    titleopenSUSE 10 Security Update : flash-player (flash-player-6387)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update flash-player-6387.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(42001);
      script_version ("1.12");
      script_cvs_date("Date: 2019/10/25 13:36:36");
    
      script_cve_id("CVE-2009-0901", "CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870", "CVE-2009-2395", "CVE-2009-2493");
    
      script_name(english:"openSUSE 10 Security Update : flash-player (flash-player-6387)");
      script_summary(english:"Check for the flash-player-6387 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Specially crafted Flash (SWF) files can cause a buffer overflow in
    flash-player. Attackers could potentially exploit that to execute
    arbitrary code (CVE-2009-1862, CVE-2009-0901, CVE-2009-2395,
    CVE-2009-2493, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865,
    CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869,
    CVE-2009-1870)."
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected flash-player package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 89, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:flash-player");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:10.3");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/10/06");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE10\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "10.3", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686)$") audit(AUDIT_ARCH_NOT, "i586 / i686", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE10.3", reference:"flash-player-9.0.246.0-0.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "flash-player");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2009-1189.NASL
    descriptionAn updated Adobe Flash Player package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3 and 4 Extras. This update has been rated as having critical security impact by the Red Hat Security Response Team. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. Multiple security flaws were found in the way Flash Player displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, possibly, execute arbitrary code when the victim loaded a page containing the specially crafted SWF content. (CVE-2009-1862, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1868, CVE-2009-1869) A clickjacking flaw was discovered in Flash Player. A specially crafted SWF file could trick a user into unintentionally or mistakenly clicking a link or a dialog. (CVE-2009-1867) A flaw was found in the Flash Player local sandbox. A specially crafted SWF file could cause information disclosure when it was saved to the hard drive. (CVE-2009-1870) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 9.0.246.0.
    last seen2020-06-01
    modified2020-06-02
    plugin id63887
    published2013-01-24
    reporterThis script is Copyright (C) 2013-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/63887
    titleRHEL 3 / 4 : flash-plugin (RHSA-2009:1189)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2009:1189. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(63887);
      script_version("1.10");
      script_cvs_date("Date: 2019/10/25 13:36:14");
    
      script_cve_id("CVE-2009-1862", "CVE-2009-1863", "CVE-2009-1864", "CVE-2009-1865", "CVE-2009-1866", "CVE-2009-1867", "CVE-2009-1868", "CVE-2009-1869", "CVE-2009-1870");
      script_xref(name:"RHSA", value:"2009:1189");
    
      script_name(english:"RHEL 3 / 4 : flash-plugin (RHSA-2009:1189)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An updated Adobe Flash Player package that fixes multiple security
    issues is now available for Red Hat Enterprise Linux 3 and 4 Extras.
    
    This update has been rated as having critical security impact by the
    Red Hat Security Response Team.
    
    The flash-plugin package contains a Mozilla Firefox compatible Adobe
    Flash Player web browser plug-in.
    
    Multiple security flaws were found in the way Flash Player displayed
    certain SWF content. An attacker could use these flaws to create a
    specially crafted SWF file that would cause flash-plugin to crash or,
    possibly, execute arbitrary code when the victim loaded a page
    containing the specially crafted SWF content. (CVE-2009-1862,
    CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866,
    CVE-2009-1868, CVE-2009-1869)
    
    A clickjacking flaw was discovered in Flash Player. A
    specially crafted SWF file could trick a user into unintentionally or
    mistakenly clicking a link or a dialog. (CVE-2009-1867)
    
    A flaw was found in the Flash Player local sandbox. A
    specially crafted SWF file could cause information disclosure when it
    was saved to the hard drive. (CVE-2009-1870)
    
    All users of Adobe Flash Player should install this updated package,
    which upgrades Flash Player to version 9.0.246.0."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1862.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1863.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1864.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1865.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1866.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1867.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1868.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1869.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.redhat.com/security/data/cve/CVE-2009-1870.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.adobe.com/support/security/bulletins/apsb09-10.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://rhn.redhat.com/errata/RHSA-2009-1189.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected flash-plugin package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(59, 94, 119, 189, 200, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:flash-plugin");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:3");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4.8");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2009/07/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/24");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2019 Tenable Network Security, Inc.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    flag = 0;
    if (rpm_check(release:"RHEL3", cpu:"i386", reference:"flash-plugin-9.0.246.0-2.el3.with.oss")) flag++;
    
    if (rpm_check(release:"RHEL4", cpu:"i386", reference:"flash-plugin-9.0.246.0-2.el4")) flag++;
    
    if (rpm_check(release:"RHEL4", sp:"8", cpu:"i386", reference:"flash-plugin-9.0.246.0-2.el4")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    

Oval

  • accepted2013-02-04T04:00:51.996-05:00
    classvulnerability
    contributors
    nameShane Shaffer
    organizationG2, Inc.
    definition_extensions
    • commentAdobe Flash Player is Installed
      ovaloval:org.mitre.oval:def:12319
    • commentAdobe Flash Player 10 is Installed
      ovaloval:org.mitre.oval:def:12412
    • commentAdobe AIR is installed
      ovaloval:org.mitre.oval:def:15988
    descriptionStack-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.
    familymacos
    idoval:org.mitre.oval:def:16198
    statusaccepted
    submitted2012-12-20T15:35:55.661-05:00
    titleAdobe Flash Player and AIR Stack Buffer Overflow Vulnerability
    version4
  • accepted2015-08-03T04:02:04.316-04:00
    classvulnerability
    contributors
    • nameJ. Daniel Brown
      organizationDTCC
    • nameJ. Daniel Brown
      organizationDTCC
    • nameShane Shaffer
      organizationG2, Inc.
    • nameMaria Kedovskaya
      organizationALTX-SOFT
    • nameMaria Kedovskaya
      organizationALTX-SOFT
    • nameMaria Kedovskaya
      organizationALTX-SOFT
    • nameMaria Mikhno
      organizationALTX-SOFT
    • nameMaria Mikhno
      organizationALTX-SOFT
    definition_extensions
    • commentAdobe AIR is installed
      ovaloval:org.mitre.oval:def:7479
    • commentAdobe Flash Player 10 is installed
      ovaloval:org.mitre.oval:def:7610
    • commentAdobe Flash Player 9 is installed
      ovaloval:org.mitre.oval:def:7402
    • commentActiveX Control is installed
      ovaloval:org.mitre.oval:def:26707
    descriptionStack-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.
    familywindows
    idoval:org.mitre.oval:def:7271
    statusaccepted
    submitted2010-01-14T12:00:00.000-05:00
    titleAdobe Flash Player and AIR Stack Buffer Overflow Vulnerability
    version62

Redhat

rpms
  • flash-plugin-0:10.0.32.18-2.el5
  • flash-plugin-0:9.0.246.0-2.el3.with.oss
  • flash-plugin-0:9.0.246.0-2.el4

Seebug

bulletinFamilyexploit
descriptionBugraq ID: 35890 CVE ID:CVE-2009-1863 CVE-2009-1864 CVE-2009-1865 CVE-2009-1866 CVE-2009-1867 CVE-2009-1868 CVE-2009-1869 CVE-2009-1870 CNCVE ID:CNCVE-20091863 CNCVE-20091864 CNCVE-20091865 CNCVE-20091866 CNCVE-20091867 CNCVE-20091868 CNCVE-20091869 CNCVE-20091870 Adobe Flash Player是一款Flash文件处理程序。Adobe AIR是Adobe公司出品的跨操作系统的运行时库,通过它开发者可利用现有的Web开发技术。 Windows, Macintosh和Linux系统上的Adobe Flash Player (v9.0.159.0和v10.0.22.87)版本存在多个严重安全问题,这些漏洞可导致应用程序崩溃,也可能使攻击者控制受影响系统。 Adobe建议Adobe Flash Player 9.x和10.x及之前版本的用户尽快升级到Adobe Flash Player 9.0.246.0和10.0.32.18。Adobe也建议Adobe AIR 1.5.1及之前版本用户升级到Adobe AIR 1.5.2。 Adobe Flash Player 10.0.22 .87 Adobe Flash Player 10.0.15 .3 Adobe Flash Player 10.0.12 .36 Adobe Flash Player 10.0.12 .35 Adobe Flash Player 9.0.159 0 Adobe Flash Player 9.0.152 .0 Adobe Flash Player 9.0.151 .0 Adobe Flash Player 9.0.124 .0 Adobe Flash Player 9.0.48.0 Adobe Flash Player 9.0.47.0 Adobe Flash Player 9.0.45.0 Adobe Flash Player 9.0.31.0 Adobe Flash Player 9.0.28.0 Adobe Flash Player 9.0.115.0 Adobe Flash Player 9 Adobe Flash Player 10 Adobe AIR 1.5.1 Adobe AIR 1.5 Adobe AIR 1.1 Adobe AIR 1.01 Adobe AIR 1.0 Adobe建议所有Adobe Flash Player 10.0.22.87及之前版本用户通过Player Download Center(http://www.adobe.com/go/getflashplayer)升级到10.0.32.18最新版本,或者在当产品提示升级时启用自动升级机制。 针对不能升级到Adobe Flash Player 10的用户,Adobe开发了补丁程序,可从如下地址获得: http://www.adobe.com/products/flashplayer/fp_distribution3.html Adobe建议Adobe AIR 1.5.1及之前版本用户通过Adobe AIR Download Center(http://get.adobe.com/air)升级到Adobe AIR 1.5.2。
idSSV:11953
last seen2017-11-19
modified2009-07-31
published2009-07-31
reporterRoot
titleAdobe Flash Player和AIR存在多个安全漏洞