Vulnerabilities > CVE-2012-1535

047910
CVSS 7.8 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
local
low complexity
adobe
redhat
opensuse
suse
nessus
exploit available
metasploit

Summary

Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.

Vulnerable Configurations

Part Description Count
Application
Adobe
245
OS
Apple
1
OS
Microsoft
1
OS
Linux
1
OS
Redhat
3
OS
Opensuse
2
OS
Suse
1

Exploit-Db

descriptionAdobe Flash Player 11.3 Font Parsing Code Execution. CVE-2012-1535. Remote exploit for windows platform
idEDB-ID:20624
last seen2016-02-02
modified2012-08-20
published2012-08-20
reportermetasploit
sourcehttps://www.exploit-db.com/download/20624/
titleAdobe Flash Player 11.3 Font Parsing Code Execution

Metasploit

descriptionThis module exploits a vulnerability found in the ActiveX component of Adobe Flash Player before 11.3.300.271. By supplying a specially crafted .otf font file with a large nTables value in the 'kern' header, it is possible to trigger an integer overflow, which results in remote code execution under the context of the user. This vulnerability has also been exploited in the wild in limited targeted attacks. Please note in order to ensure reliability, the exploit is forced to modify your URIPATH parameter to less than 3 characters, which may cause possible URIPATH collisions.
idMSF:EXPLOIT/WINDOWS/BROWSER/ADOBE_FLASH_OTF_FONT
last seen2020-06-02
modified2020-02-18
published2012-08-17
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/browser/adobe_flash_otf_font.rb
titleAdobe Flash Player 11.3 Kern Table Parsing Integer Overflow

Nessus

  • NASL familyWindows
    NASL idHP_SYSTEMS_INSIGHT_MANAGER_72_MULTIPLE_VULNS.NASL
    descriptionThe version of HP Systems Insight Manager installed on the remote Windows host is affected by vulnerabilities in the included Flash components.
    last seen2020-06-01
    modified2020-06-02
    plugin id72963
    published2014-03-12
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/72963
    titleHP Systems Insight Manager < 7.2 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(72963);
      script_version("1.7");
      script_cvs_date("Date: 2018/11/15 20:50:27");
    
      script_cve_id(
        "CVE-2012-1535",
        "CVE-2012-4163",
        "CVE-2012-4164",
        "CVE-2012-4165",
        "CVE-2012-4167",
        "CVE-2012-4168"
      );
      script_bugtraq_id(55009, 56189, 56192, 56196, 56197, 56199);
      script_xref(name:"EDB-ID", value:"20624");
      script_xref(name:"HP", value:"emr_na-c03651388");
      script_xref(name:"HP", value:"HPSBMU02948");
      script_xref(name:"HP", value:"SSRT100986");
    
      script_name(english:"HP Systems Insight Manager < 7.2 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of HP Systems Insight Manager.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains software that is affected by multiple
    vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of HP Systems Insight Manager installed on the remote
    Windows host is affected by vulnerabilities in the included Flash
    components.");
      # https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c04039150-1
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?39ef0afe");
      # https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c03651388
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6d0c8735");
      script_set_attribute(attribute:"solution", value:"Upgrade to HP Systems Insight Manager 7.2 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Adobe Flash Player 11.3 Kern Table Parsing Integer Overflow');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/15");
      script_set_attribute(attribute:"patch_publication_date", value:"2013/03/01");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/03/12");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:hp:systems_insight_manager");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");
    
      script_dependencies("hp_systems_insight_manager_installed.nasl");
      script_require_keys("installed_sw/HP Systems Insight Manager");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("install_func.inc");
    include("misc_func.inc");
    
    app_name = "HP Systems Insight Manager";
    get_install_count(app_name:app_name, exit_if_zero:TRUE);
    
    install = get_single_install(app_name:app_name);
    path = install['path'];
    version = install['version'];
    
    if (version =~ '^(([A-Z]\\.)?0[0-6]\\.|([A-C]\\.)?07\\.0[01]\\.[0-9\\.]+)')
    {
      port = get_kb_item('SMB/transport');
      if (!port) port = 445;
    
      if (report_verbosity > 0)
      {
        report =
          '\n  Path              : ' + path +
          '\n  Installed version : ' + version +
          '\n  Fixed version     : C.07.02.00.00' +
          '\n';
        security_hole(port:port, extra:report);
      }
      else security_hole(port);
    }
    else audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, path);
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-518.NASL
    descriptionAdobe Flash Player was updated to 11.2.202.238 fixing various bugs and security issues.
    last seen2020-06-05
    modified2014-06-13
    plugin id74716
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74716
    titleopenSUSE Security Update : flash-player (openSUSE-SU-2012:0996-1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2012-518.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(74716);
      script_version("1.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-1535");
    
      script_name(english:"openSUSE Security Update : flash-player (openSUSE-SU-2012:0996-1)");
      script_summary(english:"Check for the openSUSE-2012-518 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Adobe Flash Player was updated to 11.2.202.238 fixing various bugs and
    security issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=775986"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.opensuse.org/opensuse-updates/2012-08/msg00027.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected flash-player packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Adobe Flash Player 11.3 Kern Table Parsing Integer Overflow');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:flash-player");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:flash-player-gnome");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:flash-player-kde4");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/15");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE12\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.1", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE12.1", reference:"flash-player-11.2.202.238-27.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"flash-player-gnome-11.2.202.238-27.1") ) flag++;
    if ( rpm_check(release:"SUSE12.1", reference:"flash-player-kde4-11.2.202.238-27.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "flash-player");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_FLASH-PLAYER-120815.NASL
    descriptionThis update of flash-player fixes a security issue that could allow attackers to execute arbitrary code remotely. (CVE-2012-1535)
    last seen2020-06-05
    modified2013-01-25
    plugin id64139
    published2013-01-25
    reporterThis script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/64139
    titleSuSE 11.1 Security Update : flash-player (SAT Patch Number 6678)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from SuSE 11 update information. The text itself is
    # copyright (C) Novell, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(64139);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-1535");
    
      script_name(english:"SuSE 11.1 Security Update : flash-player (SAT Patch Number 6678)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 11 host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update of flash-player fixes a security issue that could allow
    attackers to execute arbitrary code remotely. (CVE-2012-1535)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=775986"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1535.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply SAT patch number 6678.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Adobe Flash Player 11.3 Kern Table Parsing Integer Overflow');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:flash-player");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/25");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);
    
    pl = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(pl) || int(pl) != 1) audit(AUDIT_OS_NOT, "SuSE 11.1");
    
    
    flag = 0;
    if (rpm_check(release:"SLED11", sp:1, cpu:"i586", reference:"flash-player-11.2.202.238-0.3.1")) flag++;
    if (rpm_check(release:"SLED11", sp:1, cpu:"x86_64", reference:"flash-player-11.2.202.238-0.3.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FLASH_PLAYER_11_3_300_271.NASL
    descriptionAccording to its version, the instance of Flash Player installed on the remote Mac OS X host is 11.x equal to or earlier than 11.3.300.270. It is, therefore, potentially affected by an unspecified remote code execution vulnerability. Also note the vendor states 10.x versions are not affected by this vulnerability and the branch was not updated.
    last seen2020-06-01
    modified2020-06-02
    plugin id61551
    published2012-08-15
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/61551
    titleFlash Player for Mac <= 11.3.300.270 Code Execution (APSB12-18)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61551);
      script_version("1.14");
      script_cvs_date("Date: 2018/07/14  1:59:35");
    
      script_cve_id("CVE-2012-1535");
      script_bugtraq_id(55009);
    
      script_name(english:"Flash Player for Mac <= 11.3.300.270 Code Execution (APSB12-18)");
      script_summary(english:"Checks version of Flash Player");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "The remote Mac OS X host has a browser plugin that is affected by a
    remote code execution vulnerability."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "According to its version, the instance of Flash Player installed on the
    remote Mac OS X host is 11.x equal to or earlier than 11.3.300.270.  It
    is, therefore, potentially affected by an unspecified remote code
    execution vulnerability.
    
    Also note the vendor states 10.x versions are not affected by this
    vulnerability and the branch was not updated."
      );
      script_set_attribute(attribute:"see_also", value:"http://www.adobe.com/support/security/bulletins/apsb12-18.html");
      script_set_attribute(attribute:"see_also", value:"http://forums.adobe.com/thread/1049526");
      script_set_attribute(attribute:"solution", value:"Upgrade to Adobe Flash Player version 11.3.300.271 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Adobe Flash Player 11.3 Kern Table Parsing Integer Overflow');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/15");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:flash_player");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
    
      script_dependencies("macosx_flash_player_installed.nasl");
      script_require_keys("MacOSX/Flash_Player/Version");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    
    
    version = get_kb_item_or_exit("MacOSX/Flash_Player/Version");
    
    # nb: we're checking for versions less than *or equal to* the cutoff!
    elevenx_cutoff_version = "11.3.300.270";
    elevenx_fixed_version  = "11.3.300.271";
    fixed_version_for_report = NULL;
    
    # 11x
    if (
      version =~ "^11\." &&
      ver_compare(ver:version, fix:elevenx_cutoff_version, strict:FALSE) <= 0
    ) fixed_version_for_report = elevenx_fixed_version;
    
    if (!isnull(fixed_version_for_report))
    {
      if (report_verbosity > 0)
      {
        report = 
          '\n  Installed version : ' + version + 
          '\n  Fixed version     : '+fixed_version_for_report+'\n';
        security_hole(port:0, extra:report);
      }
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_INST_VER_NOT_VULN, "Flash Player for Mac", version);
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2012-1173.NASL
    descriptionAn updated Adobe Flash Player package that fixes one security issue is now available for Red Hat Enterprise Linux 6 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes one vulnerability in Adobe Flash Player. This vulnerability is detailed on the Adobe security page APSB12-18, listed in the References section. Specially crafted SWF content could cause flash-plugin to crash or, potentially, execute arbitrary code when a victim loads a page containing the malicious SWF content. (CVE-2012-1535) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.238.
    last seen2020-06-01
    modified2020-06-02
    plugin id61559
    published2012-08-16
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61559
    titleRHEL 6 : flash-plugin (RHSA-2012:1173)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2012:1173. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61559);
      script_version ("1.31");
      script_cvs_date("Date: 2019/10/24 15:35:36");
    
      script_cve_id("CVE-2012-1535", "CVE-2012-4163", "CVE-2012-4164", "CVE-2012-4165", "CVE-2012-4167", "CVE-2012-4168", "CVE-2012-5054");
      script_bugtraq_id(55009);
      script_xref(name:"RHSA", value:"2012:1173");
    
      script_name(english:"RHEL 6 : flash-plugin (RHSA-2012:1173)");
      script_summary(english:"Checks the rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An updated Adobe Flash Player package that fixes one security issue is
    now available for Red Hat Enterprise Linux 6 Supplementary.
    
    The Red Hat Security Response Team has rated this update as having
    critical security impact. A Common Vulnerability Scoring System (CVSS)
    base score, which gives a detailed severity rating, is available from
    the CVE link in the References section.
    
    The flash-plugin package contains a Mozilla Firefox compatible Adobe
    Flash Player web browser plug-in.
    
    This update fixes one vulnerability in Adobe Flash Player. This
    vulnerability is detailed on the Adobe security page APSB12-18, listed
    in the References section. Specially crafted SWF content could cause
    flash-plugin to crash or, potentially, execute arbitrary code when a
    victim loads a page containing the malicious SWF content.
    (CVE-2012-1535)
    
    All users of Adobe Flash Player should install this updated package,
    which upgrades Flash Player to version 11.2.202.238."
      );
      # http://www.adobe.com/support/security/bulletins/apsb12-18.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.adobe.com/support/security/bulletins/apsb12-18.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2012:1173"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1535"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-4163"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-4164"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-4165"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-4166"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-4167"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-4168"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-5054"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected flash-plugin package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Adobe Flash Player 11.3 Kern Table Parsing Integer Overflow');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:flash-plugin");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6.3");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/15");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/16");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2012:1173";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL6", reference:"flash-plugin-11.2.202.238-1.el6")) flag++;
    
    
      if (flag)
      {
        flash_plugin_caveat = '\n' +
          'NOTE: This vulnerability check only applies to RedHat released\n' +
          'versions of the flash-plugin package. This check does not apply to\n' +
          'Adobe released versions of the flash-plugin package, which are\n' +
          'versioned similarly and cause collisions in detection.\n\n' +
    
          'If you are certain you are running the Adobe released package of\n' +
          'flash-plugin and are running a version of it equal or higher to the\n' +
          'RedHat version listed above then you can consider this a false\n' +
          'positive.\n';
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat() + flash_plugin_caveat
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "flash-plugin");
      }
    }
    
  • NASL familyWindows
    NASL idFLASH_PLAYER_APSB12-18.NASL
    descriptionAccording to its version, the instance of Flash Player installed on the remote Windows host is 11.x equal to or earlier than 11.3.300.270. It is, therefore, potentially affected by an unspecified remote code execution vulnerability. Note that this vulnerability is reportedly being actively exploited in the wild. Also note the vendor states 10.x versions are not affected by this vulnerability and the branch was not updated.
    last seen2020-06-01
    modified2020-06-02
    plugin id61550
    published2012-08-15
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/61550
    titleFlash Player <= 11.3.300.270 Code Execution (APSB12-18)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61550);
      script_version("1.16");
      script_cvs_date("Date: 2018/07/11 17:09:26");
    
      script_cve_id("CVE-2012-1535");
      script_bugtraq_id(55009);
    
      script_name(english:"Flash Player <= 11.3.300.270 Code Execution (APSB12-18)");
      script_summary(english:"Checks version of Flash Player");
    
      script_set_attribute(
        attribute:"synopsis",
        value:
    "The remote Windows host has a browser plugin that is affected by a
    remote code execution vulnerability."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "According to its version, the instance of Flash Player installed on the
    remote Windows host is 11.x equal to or earlier than 11.3.300.270.  It
    is, therefore, potentially affected by an unspecified remote code
    execution vulnerability. 
    
    Note that this vulnerability is reportedly being actively exploited in
    the wild.
    
    Also note the vendor states 10.x versions are not affected by this
    vulnerability and the branch was not updated."
      );
      script_set_attribute(attribute:"see_also", value:"http://www.adobe.com/support/security/bulletins/apsb12-18.html");
      script_set_attribute(attribute:"see_also", value:"http://forums.adobe.com/thread/1049526");
      script_set_attribute(attribute:"solution", value:"Upgrade to Adobe Flash Player version 11.3.300.271 later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Adobe Flash Player 11.3 Kern Table Parsing Integer Overflow');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    script_set_attribute(attribute:"vuln_publication_date", value:"2012/08/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/15");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:flash_player");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
    
      script_dependencies("flash_player_installed.nasl");
      script_require_keys("SMB/Flash_Player/installed");
    
      exit(0);
    }
    
    include("global_settings.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/Flash_Player/installed");
    
    # Identify vulnerable versions.
    info = "";
    
    # we're checking for versions less than *or equal to* the cutoff!
    foreach variant (make_list("Plugin", "ActiveX", "Chrome"))
    {
      vers = get_kb_list("SMB/Flash_Player/"+variant+"/Version/*");
      files = get_kb_list("SMB/Flash_Player/"+variant+"/File/*");
      if (!isnull(vers) && !isnull(files))
      {
        foreach key (keys(vers))
        {
          ver = vers[key];
    
          if (ver)
          {
            iver = split(ver, sep:'.', keep:FALSE);
            for (i=0; i<max_index(iver); i++)
              iver[i] = int(iver[i]);
    
            if (
              # 11.x <= 11.3.300.270
              iver[0] == 11 &&
              (
                iver[1] < 3 ||
                (
                  iver[1] == 3 &&
                  (
                    iver[2] < 300 ||
                    (iver[2] == 300 && iver[3] <= 270)
                  )
                )
              )
            )
            {
              num = key - ("SMB/Flash_Player/"+variant+"/Version/");
              file = files["SMB/Flash_Player/"+variant+"/File/"+num];
              if (variant == "Plugin")
              {
                info += '\n  Product: Browser Plugin (for Firefox / Netscape / Opera)';
              }
              else if (variant == "ActiveX")
              {
                info += '\n Product : ActiveX control (for Internet Explorer)';
              }
              else if (variant == "Chrome")
              {
                info += '\n Product : Browser Plugin (for Google Chrome)';
              }
              info += '\n  Path              : ' + file +
                      '\n  Installed version : ' + ver  +
                      '\n  Fixed version     : 11.3.300.271';
              info += '\n';
            }
          }
        }
      }
    }
    
    if (info)
    {
      if (report_verbosity > 0)
        security_hole(port:get_kb_item("SMB/transport"), extra:info);
      else
        security_hole(get_kb_item("SMB/transport"));
    }
    else
    { 
      if (thorough_tests) 
        exit(0, 'No vulnerable versions of Adobe Flash Player were found.');
      else
        exit(1, 'Google Chrome\'s built-in Flash Player may not have been detected because the \'Perform thorough tests\' setting was not enabled.');
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_FLASH-PLAYER-8249.NASL
    descriptionThis update of flash-player fixes a security issue that could allow attackers to execute arbitrary code remotely. (CVE-2012-1535)
    last seen2020-06-05
    modified2012-08-20
    plugin id61596
    published2012-08-20
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/61596
    titleSuSE 10 Security Update : flash-player (ZYPP Patch Number 8249)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The text description of this plugin is (C) Novell, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61596);
      script_version("1.7");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-1535");
    
      script_name(english:"SuSE 10 Security Update : flash-player (ZYPP Patch Number 8249)");
      script_summary(english:"Checks rpm output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 10 host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update of flash-player fixes a security issue that could allow
    attackers to execute arbitrary code remotely. (CVE-2012-1535)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-1535.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 8249.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Adobe Flash Player 11.3 Kern Table Parsing Integer Overflow');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/08/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/20");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
    if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
    if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");
    
    
    flag = 0;
    if (rpm_check(release:"SLED10", sp:4, reference:"flash-player-11.2.202.238-0.5.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else exit(0, "The host is not affected.");
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201209-01.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201209-01 (Adobe Flash Player: Multiple vulnerabilities) Multiple unspecified vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to open specially crafted SWF content, possibly resulting in execution of arbitrary code with the privileges of the process, or a Denial of Service condition. Furthermore, a remote attacker may be able to obtain sensitive information. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id61783
    published2012-09-05
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/61783
    titleGLSA-201209-01 : Adobe Flash Player: Multiple vulnerabilities
  • NASL familyWindows
    NASL idSMB_KB2755399.NASL
    descriptionThe remote host is missing KB2755399. It may, therefore, be affected by the following vulnerabilities related to the installed version of the Adobe Flash ActiveX control : - An unspecified remote code execution error exists. (CVE-2012-1535) - Multiple memory corruption errors exist that could lead to code execution. (CVE-2012-4163, CVE-2012-4164, CVE-2012-4165) - An integer overflow error exists that could lead to code execution. (CVE-2012-4167) - A cross-domain information leak error exists. (CVE-2012-4168) - An integer overflow error related to the
    last seen2020-06-01
    modified2020-06-02
    plugin id62224
    published2012-09-21
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/62224
    titleMS KB2755399: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2012-1203.NASL
    descriptionAn updated Adobe Flash Player package that fixes several security issues is now available for Red Hat Enterprise Linux 5 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes several vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed on the Adobe security pages APSB12-18 and APSB12-19, listed in the References section. Specially crafted SWF content could cause flash-plugin to crash or, potentially, execute arbitrary code when a victim loads a page containing the malicious SWF content. (CVE-2012-1535, CVE-2012-4163, CVE-2012-4164, CVE-2012-4165, CVE-2012-4166, CVE-2012-4167) A flaw in flash-plugin could allow an attacker to obtain sensitive information if a victim were tricked into visiting a specially crafted web page. (CVE-2012-4168) Note: This erratum upgrades Adobe Flash Player from version 10.3.183.20 to version 11.2.202.238. All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.238.
    last seen2020-06-01
    modified2020-06-02
    plugin id64053
    published2013-01-24
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/64053
    titleRHEL 5 : flash-plugin (RHSA-2012:1203)

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/115670/adobe_flash_otf_font.rb.txt
idPACKETSTORM:115670
last seen2016-12-05
published2012-08-17
reportersinn3r
sourcehttps://packetstormsecurity.com/files/115670/Adobe-Flash-Player-11.3-Font-Parsing-Code-Execution.html
titleAdobe Flash Player 11.3 Font Parsing Code Execution

Redhat

advisories
rhsa
idRHSA-2012:1203
rpms
  • flash-plugin-0:11.2.202.238-1.el6
  • flash-plugin-0:11.2.202.238-1.el5

Saint

bid55009
descriptionAdobe Flash Player OpenType Font Integer Overflow
idmisc_flash
osvdb84607
titleflash_opentype_font_integer_overflow
typeclient

Seebug

  • bulletinFamilyexploit
    descriptionNo description provided by source.
    idSSV:74493
    last seen2017-11-19
    modified2014-07-01
    published2014-07-01
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-74493
    titleAdobe Flash Player 11.3 Font Parsing Code Execution
  • bulletinFamilyexploit
    descriptionNo description provided by source.
    idSSV:60333
    last seen2017-11-19
    modified2012-08-18
    published2012-08-18
    reporterRoot
    titleAdobe Flash Player 远程代码执行漏洞(CVE-2012-1535)