Vulnerabilities > CVE-2010-0186 - Cross Domain Scripting vulnerability in Multiple Adobe Products
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Cross-domain vulnerability in Adobe Flash Player before 10.0.45.2, Adobe AIR before 1.5.3.9130, and Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows remote attackers to bypass intended sandbox restrictions and make cross-domain requests via unspecified vectors. Per: http://www.adobe.com/support/security/bulletins/apsb10-07.html A critical vulnerability has been identified in Adobe Reader 9.3 for Windows, Macintosh and UNIX, Adobe Acrobat 9.3 for Windows and Macintosh, and Adobe Reader 8.2 and Acrobat 8.2 for Windows and Macintosh. As described in Security Bulletin APSB10-06, this vulnerability (CVE-2010-0186) could subvert the domain sandbox and make unauthorized cross-domain requests. Affected software versions Adobe Reader 9.3 and earlier versions for Windows, Macintosh, and UNIX Adobe Acrobat 9.3 and earlier versions for Windows and Macintosh
Vulnerable Configurations
Nessus
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2010-0103.NASL description An updated Adobe Flash Player package that fixes a security issue is now available for Red Hat Enterprise Linux 3 and 4 Extras. This update has been rated as having important security impact by the Red Hat Security Response Team. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes a vulnerability in Adobe Flash Player. This vulnerability is summarized on the Adobe Security Advisory APSB10-06 page listed in the References section. If a victim loaded a web page containing specially crafted SWF content, it could cause Flash Player to perform unauthorized cross-domain requests, leading to the disclosure of sensitive data. (CVE-2010-0186) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 9.0.262.0. last seen 2020-06-01 modified 2020-06-02 plugin id 63918 published 2013-01-24 reporter This script is Copyright (C) 2013-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/63918 title RHEL 3 / 4 : flash-plugin (RHSA-2010:0103) NASL family SuSE Local Security Checks NASL id SUSE_11_FLASH-PLAYER-100214.NASL description The following bug has been fixed : Insufficient checks in flash-player allowed malicious flash applets to create illegal cross-domain requests (CVE-2010-0186). The update also fixes a denial of service condition. (CVE-2010-0187) last seen 2020-06-01 modified 2020-06-02 plugin id 44639 published 2010-02-17 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44639 title SuSE 11 Security Update : flash-player (SAT Patch Number 1977) NASL family SuSE Local Security Checks NASL id SUSE_FLASH-PLAYER-6845.NASL description The following bug has been fixed: Insufficient checks in flash-player allowed malicious flash applets to create illegal cross-domain requests (CVE-2010-0186). The update also fixes a denial of service condition. (CVE-2010-0187) last seen 2020-06-01 modified 2020-06-02 plugin id 51735 published 2011-01-27 reporter This script is Copyright (C) 2011-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/51735 title SuSE 10 Security Update : flash-player (ZYPP Patch Number 6845) NASL family Windows NASL id ADOBE_AIR_APSB10-06.NASL description The remote Windows host contains a version of Adobe AIR that is earlier than 1.5.3.9130 Such versions are potentially affected by multiple vulnerabilities : - An issue that could subvert the domain sandbox and make unauthorized cross-domain requests. (CVE-2010-0186) - An unspecified denial of service. (CVE-2010-0187) last seen 2020-06-01 modified 2020-06-02 plugin id 44595 published 2010-02-12 reporter This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44595 title Adobe AIR < 1.5.3.9130 Multiple Vulnerabilities (APSB10-06) NASL family SuSE Local Security Checks NASL id SUSE_FLASH-PLAYER-6844.NASL description The following bug has been fixed: Insufficient checks in flash-player allowed malicious flash applets to create illegal cross-domain requests (CVE-2010-0186). The update also fixes a denial of service condition. (CVE-2010-0187) last seen 2020-06-01 modified 2020-06-02 plugin id 51734 published 2011-01-27 reporter This script is Copyright (C) 2011-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/51734 title SuSE 10 Security Update : flash-player (ZYPP Patch Number 6844) NASL family SuSE Local Security Checks NASL id SUSE_ACROREAD-6879.NASL description This update of acroread fixes : - Cross-domain request vulnerability CVE-2010-0188: CVSS v2 Base Score: 6.8 An unspecified vulnerability that possibly allowed remote code execution. (CVE-2010-0186: CVSS v2 Base Score: 5.8) last seen 2020-06-01 modified 2020-06-02 plugin id 51697 published 2011-01-27 reporter This script is Copyright (C) 2011-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/51697 title SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 6879) NASL family Windows NASL id FLASH_PLAYER_APSB10_06.NASL description The remote Windows host contains a version of Adobe Flash Player that is earlier than 10.0.45.2. Such versions are potentially affected by multiple vulnerabilities : - An issue that could subvert the domain sandbox and make unauthorized cross-domain requests. (CVE-2010-0186) - An unspecified denial of service. (CVE-2010-0187) last seen 2020-06-01 modified 2020-06-02 plugin id 44596 published 2010-02-12 reporter This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44596 title Flash Player < 10.0.45.2 Multiple Vulnerabilities (APSB10-06) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2010-0114.NASL description Updated acroread packages that fix two security issues and a bug are now available for Red Hat Enterprise Linux 4 Extras and Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. Adobe Reader allows users to view and print documents in Portable Document Format (PDF). This update fixes two vulnerabilities in Adobe Reader. These vulnerabilities are summarized on the Adobe Security Advisory APSB10-07 page listed in the References section. A specially crafted PDF file could cause Adobe Reader to crash or, potentially, execute arbitrary code as the user running Adobe Reader when opened. (CVE-2010-0186, CVE-2010-0188) This update also fixes a bug where, on some systems, attempting to install or upgrade the acroread packages failed due to a package dependency issue. (BZ#557506) All Adobe Reader users should install these updated packages. They contain Adobe Reader version 9.3.1, which is not vulnerable to these issues and fixes this bug. All running instances of Adobe Reader must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 44665 published 2010-02-19 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/44665 title RHEL 4 / 5 : acroread (RHSA-2010:0114) NASL family SuSE Local Security Checks NASL id SUSE_11_0_FLASH-PLAYER-100214.NASL description Insufficient checks in flash-player allowed malicious flash applets to create illegal cross-domain requests (CVE-2010-0186). The update also fixes a denial of service condition (CVE-2010-0187). last seen 2020-06-01 modified 2020-06-02 plugin id 44636 published 2010-02-17 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44636 title openSUSE Security Update : flash-player (flash-player-1970) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_FF6519AD18E511DF9BDD001B2134EF46.NASL description Adobe Product Security Incident Response Team reports : A critical vulnerability has been identified in Adobe Flash Player version 10.0.42.34 and earlier. This vulnerability (CVE-2010-0186) could subvert the domain sandbox and make unauthorized cross-domain requests. This update also resolves a potential Denial of Service issue (CVE-2010-0187). last seen 2020-06-01 modified 2020-06-02 plugin id 44602 published 2010-02-15 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/44602 title FreeBSD : linux-flashplugin -- multiple vulnerabilities (ff6519ad-18e5-11df-9bdd-001b2134ef46) NASL family SuSE Local Security Checks NASL id SUSE_ACROREAD-6881.NASL description This update of acroread fixes : - Cross-domain request vulnerability CVE-2010-0188: CVSS v2 Base Score: 6.8 An unspecified vulnerability that possibly allowed remote code execution. (CVE-2010-0186: CVSS v2 Base Score: 5.8) last seen 2020-06-01 modified 2020-06-02 plugin id 51698 published 2011-01-27 reporter This script is Copyright (C) 2011-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/51698 title SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 6881) NASL family SuSE Local Security Checks NASL id SUSE_11_2_FLASH-PLAYER-100214.NASL description Insufficient checks in flash-player allowed malicious flash applets to create illegal cross-domain requests (CVE-2010-0186). The update also fixes a denial of service condition (CVE-2010-0187). last seen 2020-06-01 modified 2020-06-02 plugin id 44638 published 2010-02-17 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44638 title openSUSE Security Update : flash-player (flash-player-1970) NASL family MacOS X Local Security Checks NASL id MACOSX_10_6_4.NASL description The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.4. Mac OS X 10.6.4 contains security fixes for the following components : - CUPS - DesktopServices - Flash Player plug-in - Folder Manager - Help Viewer - iChat - ImageIO - Kerberos - Kernel - libcurl - Network Authorization - Open Directory - Printer Setup - Printing - Ruby - SMB File Server - SquirrelMail - Wiki Server last seen 2020-06-01 modified 2020-06-02 plugin id 47023 published 2010-06-15 reporter This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/47023 title Mac OS X 10.6.x < 10.6.4 Multiple Vulnerabilities NASL family SuSE Local Security Checks NASL id SUSE_11_1_FLASH-PLAYER-100214.NASL description Insufficient checks in flash-player allowed malicious flash applets to create illegal cross-domain requests (CVE-2010-0186). The update also fixes a denial of service condition (CVE-2010-0187). last seen 2020-06-01 modified 2020-06-02 plugin id 44637 published 2010-02-17 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44637 title openSUSE Security Update : flash-player (flash-player-1970) NASL family SuSE Local Security Checks NASL id SUSE_11_2_ACROREAD-100225.NASL description This update of acroread fixes : - CVE-2010-0186: CVSS v2 Base Score: 5.8 Cross-domain request vulnerability - CVE-2010-0188: CVSS v2 Base Score: 6.8 An unspecified vulnerability that possibly allowed remote code execution. last seen 2020-06-01 modified 2020-06-02 plugin id 44981 published 2010-03-04 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44981 title openSUSE Security Update : acroread (acroread-2068) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201101-09.NASL description The remote host is affected by the vulnerability described in GLSA-201101-09 (Adobe Flash Player: Multiple vulnerabilities) Multiple vulnerabilities were discovered in Adobe Flash Player. For further information please consult the CVE entries and the Adobe Security Bulletins referenced below. Impact : A remote attacker could entice a user to open a specially crafted SWF file, possibly resulting in the execution of arbitrary code with the privileges of the user running the application, or a Denial of Service. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 51658 published 2011-01-24 reporter This script is Copyright (C) 2011-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/51658 title GLSA-201101-09 : Adobe Flash Player: Multiple vulnerabilities NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2010-0102.NASL description An updated Adobe Flash Player package that fixes two security issues is now available for Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having important security impact by the Red Hat Security Response Team. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes two vulnerabilities in Adobe Flash Player. These vulnerabilities are summarized on the Adobe Security Advisory APSB10-06 page listed in the References section. If a victim loaded a web page containing specially crafted SWF content, it could cause Flash Player to perform unauthorized cross-domain requests, leading to the disclosure of sensitive data. (CVE-2010-0186, CVE-2010-0187) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 10.0.45.2. last seen 2020-06-01 modified 2020-06-02 plugin id 63917 published 2013-01-24 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/63917 title RHEL 5 : flash-plugin (RHSA-2010:0102) NASL family Windows NASL id ADOBE_READER_APSB10-07.NASL description The version of Adobe Reader installed on the remote host is earlier than 9.3.1 / 8.2.1. As such, it is reportedly affected by multiple vulnerabilities : - An issue that could subvert the domain sandbox and make unauthorized cross-domain requests. (CVE-2010-0186) - An unspecified vulnerability could cause the application to crash or possibly lead to arbitrary code execution. (CVE-2010-0188) last seen 2020-06-01 modified 2020-06-02 plugin id 44644 published 2010-02-17 reporter This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44644 title Adobe Reader < 9.3.1 / 8.2.1 Multiple Vulnerabilities (APSB10-07) NASL family SuSE Local Security Checks NASL id SUSE_11_ACROREAD-100225.NASL description This update of acroread fixes : - Cross-domain request vulnerability. (CVE-2010-0186 : CVSS v2 Base Score: 5.8) - An unspecified vulnerability that possibly allowed remote code execution. (CVE-2010-0188 : CVSS v2 Base Score: 6.8) last seen 2020-06-01 modified 2020-06-02 plugin id 44984 published 2010-03-04 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44984 title SuSE 11 Security Update : Acrobat Reader (SAT Patch Number 2065) NASL family MacOS X Local Security Checks NASL id MACOSX_SECUPD2010-004.NASL description The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-004 applied. This security update contains fixes for the following components : - CUPS - DesktopServices - Flash Player plug-in - Folder Manager - iChat - ImageIO - Kerberos - Kernel - libcurl - Network Authorization - Ruby - SMB File Server - SquirrelMail - Wiki Server last seen 2020-06-01 modified 2020-06-02 plugin id 47024 published 2010-06-15 reporter This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/47024 title Mac OS X Multiple Vulnerabilities (Security Update 2010-004) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201009-05.NASL description The remote host is affected by the vulnerability described in GLSA-201009-05 (Adobe Reader: Multiple vulnerabilities) Multiple vulnerabilities were discovered in Adobe Reader. For further information please consult the CVE entries and the Adobe Security Bulletins referenced below. Impact : A remote attacker might entice a user to open a specially crafted PDF file, possibly resulting in the execution of arbitrary code with the privileges of the user running the application, or bypass intended sandbox restrictions, make cross-domain requests, inject arbitrary web script or HTML, or cause a Denial of Service condition. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 49126 published 2010-09-08 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/49126 title GLSA-201009-05 : Adobe Reader: Multiple vulnerabilities NASL family Windows NASL id ADOBE_ACROBAT_APSB10-07.NASL description The version of Adobe Acrobat installed on the remote host is earlier than 9.3.1 / 8.2.1. Such versions are reportedly affected by multiple vulnerabilities : - An issue that could subvert the domain sandbox and make unauthorized cross-domain requests. (CVE-2010-0186) - An unspecified vulnerability could cause the application to crash or possibly lead to arbitrary code execution. (CVE-2010-0188) last seen 2020-06-01 modified 2020-06-02 plugin id 44643 published 2010-02-17 reporter This script is Copyright (C) 2010-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44643 title Adobe Acrobat < 9.3.1 / 8.2.1 Multiple Vulnerabilities (APSB10-07) NASL family SuSE Local Security Checks NASL id SUSE_11_1_ACROREAD-100225.NASL description This update of acroread fixes : - CVE-2010-0186: CVSS v2 Base Score: 5.8 Cross-domain request vulnerability - CVE-2010-0188: CVSS v2 Base Score: 6.8 An unspecified vulnerability that possibly allowed remote code execution. last seen 2020-06-01 modified 2020-06-02 plugin id 44978 published 2010-03-04 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44978 title openSUSE Security Update : acroread (acroread-2068) NASL family SuSE Local Security Checks NASL id SUSE_11_0_ACROREAD-100225.NASL description This update of acroread fixes : - CVE-2010-0186: CVSS v2 Base Score: 5.8 Cross-domain request vulnerability - CVE-2010-0188: CVSS v2 Base Score: 6.8 An unspecified vulnerability that possibly allowed remote code execution. last seen 2020-06-01 modified 2020-06-02 plugin id 44975 published 2010-03-04 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44975 title openSUSE Security Update : acroread (acroread-2068)
Oval
| accepted | 2015-08-03T04:02:08.790-04:00 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| contributors |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| description | Cross-domain vulnerability in Adobe Flash Player before 10.0.45.2, Adobe AIR before 1.5.3.9130, and Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows remote attackers to bypass intended sandbox restrictions and make cross-domain requests via unspecified vectors. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| family | windows | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| id | oval:org.mitre.oval:def:8518 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| status | accepted | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| submitted | 2010-02-14T12:00:00.000-05:00 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| title | Adobe Flash Player, Acrobat, Adobe Reader and AIR Cross Domain Request Vulnerability | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| version | 79 |
Redhat
| advisories |
| ||||||||||||
| rpms |
|
References
- http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
- http://secunia.com/advisories/38547
- http://secunia.com/advisories/38639
- http://secunia.com/advisories/38915
- http://secunia.com/advisories/40220
- http://secunia.com/advisories/43026
- http://security.gentoo.org/glsa/glsa-201101-09.xml
- http://securitytracker.com/id?1023585
- http://support.apple.com/kb/HT4188
- http://www.adobe.com/support/security/bulletins/apsb10-06.html
- http://www.adobe.com/support/security/bulletins/apsb10-07.html
- http://www.osvdb.org/62300
- http://www.redhat.com/support/errata/RHSA-2010-0114.html
- http://www.securityfocus.com/bid/38198
- http://www.vupen.com/english/advisories/2010/1481
- http://www.vupen.com/english/advisories/2011/0192
- https://bugzilla.redhat.com/show_bug.cgi?id=563819
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8518
- https://rhn.redhat.com/errata/RHSA-2010-0102.html
- https://rhn.redhat.com/errata/RHSA-2010-0103.html