Vulnerabilities > CVE-2016-7020 - Use After Free vulnerability in Adobe Flash Player and Flash Player Desktop Runtime

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
adobe
CWE-416
nessus

Summary

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4173, CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, CVE-2016-4230, CVE-2016-4231, and CVE-2016-4248.

Vulnerable Configurations

Part Description Count
Application
Adobe
269
OS
Apple
1
OS
Microsoft
3
OS
Google
1
OS
Linux
1

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS16-093.NASL
    descriptionThe remote Windows host is missing KB3174060. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption issues exist that allow a remote attacker to execute arbitrary code. (CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, CVE-2016-4246) - Multiple use-after-free errors exist that allow a remote attacker to execute arbitrary code. (CVE-2016-4173, CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, CVE-2016-4230, CVE-2016-4231, CVE-2016-4248, CVE-2016-7020) - Multiple stack corruption issues exist that allow a remote attacker to execute arbitrary code. (CVE-2016-4176, CVE-2016-4177) - A security bypass vulnerability exists that allows a remote attacker to disclose sensitive information. (CVE-2016-4178) - Multiple type confusion errors exist that allow a remote attacker to execute arbitrary code. (CVE-2016-4223, CVE-2016-4224, CVE-2016-4225) - An unspecified memory leak issue exists that allows an attacker to have an unspecified impact. (CVE-2016-4232) - A race condition exists that allows a remote attacker to disclose sensitive information. (CVE-2016-4247) - A heap buffer overflow condition exists that allows a remote attacker to execute arbitrary code. (CVE-2016-4249)
    last seen2020-06-01
    modified2020-06-02
    plugin id92024
    published2016-07-12
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92024
    titleMS16-093: Security Update for Adobe Flash Player (3174060)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(92024);
      script_version("1.17");
      script_cvs_date("Date: 2019/11/14");
    
      script_cve_id(
        "CVE-2016-4172",
        "CVE-2016-4173",
        "CVE-2016-4174",
        "CVE-2016-4175",
        "CVE-2016-4176",
        "CVE-2016-4177",
        "CVE-2016-4178",
        "CVE-2016-4179",
        "CVE-2016-4180",
        "CVE-2016-4181",
        "CVE-2016-4182",
        "CVE-2016-4183",
        "CVE-2016-4184",
        "CVE-2016-4185",
        "CVE-2016-4186",
        "CVE-2016-4187",
        "CVE-2016-4188",
        "CVE-2016-4189",
        "CVE-2016-4190",
        "CVE-2016-4217",
        "CVE-2016-4218",
        "CVE-2016-4219",
        "CVE-2016-4220",
        "CVE-2016-4221",
        "CVE-2016-4222",
        "CVE-2016-4223",
        "CVE-2016-4224",
        "CVE-2016-4225",
        "CVE-2016-4226",
        "CVE-2016-4227",
        "CVE-2016-4228",
        "CVE-2016-4229",
        "CVE-2016-4230",
        "CVE-2016-4231",
        "CVE-2016-4232",
        "CVE-2016-4233",
        "CVE-2016-4234",
        "CVE-2016-4235",
        "CVE-2016-4236",
        "CVE-2016-4237",
        "CVE-2016-4238",
        "CVE-2016-4239",
        "CVE-2016-4240",
        "CVE-2016-4241",
        "CVE-2016-4242",
        "CVE-2016-4243",
        "CVE-2016-4244",
        "CVE-2016-4245",
        "CVE-2016-4246",
        "CVE-2016-4247",
        "CVE-2016-4248",
        "CVE-2016-4249",
        "CVE-2016-7020"
      );
      script_bugtraq_id(
        91718,
        91719,
        91720,
        91721,
        91722,
        91723,
        91724,
        91725
      );
      script_xref(name:"MSFT", value:"MS16-093");
      script_xref(name:"MSKB", value:"3174060");
    
      script_name(english:"MS16-093: Security Update for Adobe Flash Player (3174060)");
      script_summary(english:"Checks the version of the ActiveX control.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host has a browser plugin installed that is
    affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing KB3174060. It is, therefore,
    affected by multiple vulnerabilities :
    
      - Multiple memory corruption issues exist that allow a
        remote attacker to execute arbitrary code.
        (CVE-2016-4172, CVE-2016-4175, CVE-2016-4179,
        CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
        CVE-2016-4183, CVE-2016-4184, CVE-2016-4185,
        CVE-2016-4186, CVE-2016-4187, CVE-2016-4188,
        CVE-2016-4189, CVE-2016-4190, CVE-2016-4217,
        CVE-2016-4218, CVE-2016-4219, CVE-2016-4220,
        CVE-2016-4221, CVE-2016-4233, CVE-2016-4234,
        CVE-2016-4235, CVE-2016-4236, CVE-2016-4237,
        CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
        CVE-2016-4241, CVE-2016-4242, CVE-2016-4243,
        CVE-2016-4244, CVE-2016-4245, CVE-2016-4246)
    
      - Multiple use-after-free errors exist that allow a remote
        attacker to execute arbitrary code. (CVE-2016-4173,
        CVE-2016-4174, CVE-2016-4222, CVE-2016-4226,
        CVE-2016-4227, CVE-2016-4228, CVE-2016-4229,
        CVE-2016-4230, CVE-2016-4231, CVE-2016-4248,
        CVE-2016-7020)
    
      - Multiple stack corruption issues exist that allow a
        remote attacker to execute arbitrary code.
        (CVE-2016-4176, CVE-2016-4177)
    
      - A security bypass vulnerability exists that allows a
        remote attacker to disclose sensitive information.
        (CVE-2016-4178)
    
      - Multiple type confusion errors exist that allow a remote
        attacker to execute arbitrary code. (CVE-2016-4223,
        CVE-2016-4224, CVE-2016-4225)
    
      - An unspecified memory leak issue exists that allows an
        attacker to have an unspecified impact. (CVE-2016-4232)
    
      - A race condition exists that allows a remote attacker to
        disclose sensitive information. (CVE-2016-4247)
    
      - A heap buffer overflow condition exists that allows a
        remote attacker to execute arbitrary code.
        (CVE-2016-4249)");
      script_set_attribute(attribute:"see_also", value:"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2016/ms16-093");
      script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/flash-player/apsb16-25.html");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released a set of patches for Windows 2012, 8.1, RT 8.1,
    2012 R2, and 10.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-7020");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/07/12");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/07/12");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/07/12");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:flash_player");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
    
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_activex_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS16-093";
    kbs = make_list("3174060");
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win8:'0', win81:'0', win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    if (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);
    
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    if ("Windows 8" >< productname && "Windows 8.1" >!< productname) audit(AUDIT_OS_SP_NOT_VULN);
    
    if (activex_init() != ACX_OK) audit(AUDIT_FN_FAIL, "activex_init()");
    
    # Adobe Flash Player CLSID
    clsid = '{D27CDB6E-AE6D-11cf-96B8-444553540000}';
    
    file = activex_get_filename(clsid:clsid);
    if (isnull(file))
    {
      activex_end();
      audit(AUDIT_FN_FAIL, "activex_get_filename", "NULL");
    }
    if (!file)
    {
      activex_end();
      audit(AUDIT_ACTIVEX_NOT_FOUND, clsid);
    }
    
    # Get its version.
    version = activex_get_fileversion(clsid:clsid);
    if (!version)
    {
      activex_end();
      audit(AUDIT_VER_FAIL, file);
    }
    
    info = '';
    
    iver = split(version, sep:'.', keep:FALSE);
    for (i=0; i<max_index(iver); i++)
     iver[i] = int(iver[i]);
    iver = join(iver, sep:".");
    
    # all <= 18.0.0.352 or 19 <= 21.0.0.242
    fix = FALSE;
    if(iver =~ "^(19|2[01])\." && ver_compare(ver:iver, fix:"22.0.0.192", strict:FALSE) <= 0)
      fix = "22.0.0.209";
    else if(ver_compare(ver:iver, fix:"18.0.0.360", strict:FALSE) <= 0)
      fix = "18.0.0.366";
    
    if (
      (report_paranoia > 1 || activex_get_killbit(clsid:clsid) == 0) &&
      fix
    )
    {
      info = '\n  Path              : ' + file +
             '\n  Installed version : ' + version +
             '\n  Fixed version     : ' + fix +
             '\n';
    }
    
    port = kb_smb_transport();
    
    if (info != '')
    {
      if (report_paranoia > 1)
      {
        report = info +
          '\n' +
          'Note, though, that Nessus did not check whether the kill bit was\n' +
          "set for the control's CLSID because of the Report Paranoia setting" + '\n' +
          'in effect when this scan was run.\n';
      }
      else
      {
        report = info +
          '\n' +
          'Moreover, its kill bit is not set so it is accessible via Internet\n' +
          'Explorer.\n';
      }
      set_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
      hotfix_add_report(bulletin:'MS16-093', kb:'3174060', report);
      security_report_v4(severity:SECURITY_HOLE, port:port, extra:hotfix_get_report());
    }
    else audit(AUDIT_HOST_NOT, 'affected');
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2016-1423.NASL
    descriptionAn update for flash-plugin is now available for Red Hat Enterprise Linux 5 Supplementary and Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 11.2.202.632. Security Fix(es) : * This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2016-4172, CVE-2016-4173, CVE-2016-4174, CVE-2016-4175, CVE-2016-4176, CVE-2016-4177, CVE-2016-4178, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4222, CVE-2016-4223, CVE-2016-4224, CVE-2016-4225, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, CVE-2016-4230, CVE-2016-4231, CVE-2016-4232, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, CVE-2016-4246, CVE-2016-4247, CVE-2016-4248, CVE-2016-4249)
    last seen2020-06-01
    modified2020-06-02
    plugin id92044
    published2016-07-14
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92044
    titleRHEL 5 / 6 : flash-plugin (RHSA-2016:1423)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FLASH_PLAYER_APSB16-25.NASL
    descriptionThe version of Adobe Flash Player installed on the remote Mac OS X host is equal or prior to version 22.0.0.192. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption issues exist that allow a remote attacker to execute arbitrary code. (CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, CVE-2016-4246) - Multiple use-after-free errors exist that allow a remote attacker to execute arbitrary code. (CVE-2016-4173, CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, CVE-2016-4230, CVE-2016-4231, CVE-2016-4248, CVE-2016-7020) - Multiple stack corruption issues exist that allow a remote attacker to execute arbitrary code. (CVE-2016-4176, CVE-2016-4177) - A security bypass vulnerability exists that allows a remote attacker to disclose sensitive information. (CVE-2016-4178) - Multiple type confusion errors exist that allow a remote attacker to execute arbitrary code. (CVE-2016-4223, CVE-2016-4224, CVE-2016-4225) - An unspecified memory leak issue exists that allows an attacker to have an unspecified impact. (CVE-2016-4232) - A race condition exists that allows a remote attacker to disclose sensitive information. (CVE-2016-4247) - A heap buffer overflow condition exists that allows a remote attacker to execute arbitrary code. (CVE-2016-4249)
    last seen2020-06-01
    modified2020-06-02
    plugin id92013
    published2016-07-12
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92013
    titleAdobe Flash Player for Mac <= 22.0.0.192 Multiple Vulnerabilities (APSB16-25)
  • NASL familyWindows
    NASL idFLASH_PLAYER_APSB16-25.NASL
    descriptionThe version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 22.0.0.192. It is, therefore, affected by multiple Vulnerabilities : - Multiple memory corruption issues exist that allow a remote attacker to execute arbitrary code. (CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, CVE-2016-4246) - Multiple use-after-free errors exist that allow a remote attacker to execute arbitrary code. (CVE-2016-4173, CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, CVE-2016-4230, CVE-2016-4231, CVE-2016-4248, CVE-2016-7020) - Multiple stack corruption issues exist that allow a remote attacker to execute arbitrary code. (CVE-2016-4176, CVE-2016-4177) - A security bypass vulnerability exists that allows a remote attacker to disclose sensitive information. (CVE-2016-4178) - Multiple type confusion errors exist that allow a remote attacker to execute arbitrary code. (CVE-2016-4223, CVE-2016-4224, CVE-2016-4225) - An unspecified memory leak issue exists that allows an attacker to have an unspecified impact. (CVE-2016-4232) - A race condition exists that allows a remote attacker to disclose sensitive information. (CVE-2016-4247) - A heap buffer overflow condition exists that allows a remote attacker to execute arbitrary code. (CVE-2016-4249)
    last seen2020-06-01
    modified2020-06-02
    plugin id92012
    published2016-07-12
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92012
    titleAdobe Flash Player <= 22.0.0.192 Multiple Vulnerabilities (APSB16-25)

Redhat

advisories
rhsa
idRHSA-2016:1423
rpms
  • flash-plugin-0:11.2.202.632-1.el5_11
  • flash-plugin-0:11.2.202.632-1.el6_8