Vulnerabilities > CVE-2012-0779 - Unspecified vulnerability in Adobe Flash Player
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on Android 2.x and 3.x; and before 11.1.115.8 on Android 4.x allows remote attackers to execute arbitrary code via a crafted file, related to an "object confusion vulnerability," as exploited in the wild in May 2012.
Vulnerable Configurations
Exploit-Db
| description | Adobe Flash Player Object Type Confusion. CVE-2012-0779. Remote exploit for windows platform |
| id | EDB-ID:19369 |
| last seen | 2016-02-02 |
| modified | 2012-06-25 |
| published | 2012-06-25 |
| reporter | metasploit |
| source | https://www.exploit-db.com/download/19369/ |
| title | Adobe Flash Player Object Type Confusion |
Metasploit
| description | This module exploits a vulnerability found in Adobe Flash Player. By supplying a corrupt AMF0 "_error" response, it is possible to gain arbitrary remote code execution under the context of the user. This vulnerability has been exploited in the wild as part of the "World Uyghur Congress Invitation.doc" e-mail attack. According to the advisory, 10.3.183.19 and 11.x before 11.2.202.235 are affected. |
| id | MSF:EXPLOIT/WINDOWS/BROWSER/ADOBE_FLASH_RTMP |
| last seen | 2020-06-10 |
| modified | 2020-02-18 |
| published | 2012-06-22 |
| references |
|
| reporter | Rapid7 |
| source | https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/browser/adobe_flash_rtmp.rb |
| title | Adobe Flash Player Object Type Confusion |
Nessus
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201206-21.NASL description The remote host is affected by the vulnerability described in GLSA-201206-21 (Adobe Flash Player: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to open a specially crafted SWF file, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 59674 published 2012-06-25 reporter This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/59674 title GLSA-201206-21 : Adobe Flash Player: Multiple vulnerabilities NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2012-0688.NASL description An updated Adobe Flash Player package that fixes one security issue is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes one vulnerability in Adobe Flash Player. This vulnerability is detailed on the Adobe security page APSB12-09, listed in the References section. Specially crafted SWF content could cause flash-plugin to crash or, potentially, execute arbitrary code when a victim loads a page containing the specially crafted SWF content. (CVE-2012-0779) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 10.3.183.19. last seen 2020-06-01 modified 2020-06-02 plugin id 59253 published 2012-05-24 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/59253 title RHEL 5 / 6 : flash-plugin (RHSA-2012:0688) NASL family SuSE Local Security Checks NASL id SUSE_11_FLASH-PLAYER-120506.NASL description Flash Player was updated to version 11.2.202.233, fixing a critical security problem. This update also fixes a problem with NVIDIA accelerated drivers and swapped blue/red colors, and also a printing regression introduced by a previous update. last seen 2020-06-05 modified 2013-01-25 plugin id 64137 published 2013-01-25 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/64137 title SuSE 11.1 Security Update : flash-player (SAT Patch Number 6253) NASL family SuSE Local Security Checks NASL id SUSE_FLASH-PLAYER-8116.NASL description Flash Player was updated to version 11.2.202.233, fixing a critical security problem. last seen 2020-06-05 modified 2012-05-09 plugin id 59054 published 2012-05-09 reporter This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/59054 title SuSE 10 Security Update : flash-player (ZYPP Patch Number 8116) NASL family MacOS X Local Security Checks NASL id MACOSX_FLASH_PLAYER_11_2_202_235.NASL description According to its version, the instance of Flash Player installed on the remote Mac OS X host is 10.x equal to or earlier than 10.3.183.18 or 11.x equal to or earlier than 11.2.202.233. It is, therefore, reportedly affected by an object confusion vulnerability that could allow an attacker to crash the application or potentially take control of the target system. By tricking a victim into visiting a specially crafted page, an attacker may be able to utilize this vulnerability to execute arbitrary code subject to the users last seen 2020-06-01 modified 2020-06-02 plugin id 58995 published 2012-05-04 reporter This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/58995 title Flash Player for Mac <= 10.3.183.18 / 11.2.202.233 Object Confusion Vulnerability (APSB12-09) NASL family Windows NASL id FLASH_PLAYER_APSB12-09.NASL description According to its version, the instance of Flash Player installed on the remote Windows host is 10.x equal to or earlier than 10.3.183.18 or 11.x equal to or earlier than 11.2.202.233. It is, therefore, reportedly affected by an object confusion vulnerability that could allow an attacker to crash the application or potentially take control of the target system. By tricking a victim into visiting a specially crafted page, an attacker may be able to utilize this vulnerability to execute arbitrary code subject to the users last seen 2020-06-01 modified 2020-06-02 plugin id 58994 published 2012-05-04 reporter This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/58994 title Flash Player <= 10.3.183.18 / 11.2.202.233 Object Confusion Vulnerability (APSB12-09) NASL family SuSE Local Security Checks NASL id OPENSUSE-2012-262.NASL description flash-player update to 11.2.202.235 fixes a potential remote code execution vulnerability last seen 2020-06-05 modified 2014-06-13 plugin id 74617 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/74617 title openSUSE Security Update : flash-player (openSUSE-SU-2012:0594-1)
Packetstorm
| data source | https://packetstormsecurity.com/files/download/114107/adobe_flash_rtmp.rb.txt |
| id | PACKETSTORM:114107 |
| last seen | 2016-12-05 |
| published | 2012-06-23 |
| reporter | sinn3r |
| source | https://packetstormsecurity.com/files/114107/Adobe-Flash-Player-Object-Type-Confusion.html |
| title | Adobe Flash Player Object Type Confusion |
Redhat
| advisories |
| ||||
| rpms |
|
Saint
| bid | 53395 |
| description | Adobe Flash Player Object Confusion Code Execution |
| id | misc_flash |
| osvdb | 81656 |
| title | flash_object_confusion |
| type | client |
Seebug
bulletinFamily exploit description BUGTRAQ ID: 53395 CVE ID: CVE-2012-0779 Adobe Flash Player是一个集成的多媒体播放器。 Adobe Flash Player在实现上存在对象混淆漏洞，通过诱使用户打开电子邮件中的恶意文件，攻击者可利用此漏洞使应用崩溃，执行任意代码，控制受影响系统。 0 Adobe Flash Player 11.x Adobe Flash Player 10.x 厂商补丁： Adobe ----- Adobe已经为此发布了一个安全公告（apsb12-09）以及相应补丁: apsb12-09：Security update available for Adobe Flash Player 链接：http://www.adobe.com/support/security/bulletins/apsb12-09.html id SSV:60099 last seen 2017-11-19 modified 2012-05-09 published 2012-05-09 reporter Root title Adobe Flash Player对象类型混淆远程代码执行漏洞(CVE-2012-0779) bulletinFamily exploit description No description provided by source. id SSV:73304 last seen 2017-11-19 modified 2014-07-01 published 2014-07-01 reporter Root source https://www.seebug.org/vuldb/ssvid-73304 title Adobe Flash Player Object Type Confusion
References
- http://www.adobe.com/support/security/bulletins/apsb12-09.html
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00005.html
- http://osvdb.org/81656
- http://secunia.com/advisories/49038
- http://www.securitytracker.com/id?1027023
- http://secunia.com/advisories/49096
- http://www.securityfocus.com/bid/53395
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75383
- http://rhn.redhat.com/errata/RHSA-2012-0688.html