Vulnerabilities > CVE-2018-4937 - Out-of-bounds Write vulnerability in Adobe Flash Player and Flash Player Desktop Runtime

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
adobe
CWE-787
nessus
exploit available

Summary

Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Vulnerable Configurations

Part Description Count
Application
Adobe
105
OS
Microsoft
3
OS
Apple
1
OS
Linux
1
OS
Google
1

Common Weakness Enumeration (CWE)

Exploit-Db

descriptionAdobe Flash - Out-of-Bounds Write in blur Filtering. CVE-2018-4937. Dos exploit for Multiple platform
fileexploits/multiple/dos/44529.txt
idEDB-ID:44529
last seen2018-05-24
modified2018-04-24
platformmultiple
port
published2018-04-24
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/44529/
titleAdobe Flash - Out-of-Bounds Write in blur Filtering
typedos

Nessus

  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FLASH_PLAYER_APSB18-08.NASL
    descriptionThe version of Adobe Flash Player installed on the remote macOS or Mac OS X host is equal or prior to version 29.0.0.113. It is therefore affected by multiple vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id108959
    published2018-04-10
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108959
    titleAdobe Flash Player for Mac <= 29.0.0.113 (APSB18-08)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(108959);
      script_version("1.6");
      script_cvs_date("Date: 2019/04/05 23:25:06");
    
      script_cve_id(
        "CVE-2018-4932",
        "CVE-2018-4933",
        "CVE-2018-4934",
        "CVE-2018-4935",
        "CVE-2018-4936",
        "CVE-2018-4937"
      );
    
      script_name(english:"Adobe Flash Player for Mac <= 29.0.0.113 (APSB18-08)");
      script_summary(english:"Checks the version of the ActiveX control.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote macOS or Mac OSX host has a browser plugin installed that is
    affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Adobe Flash Player installed on the remote macOS or Mac
    OS X host is equal or prior to version 29.0.0.113.
    It is therefore affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/flash-player/apsb18-08.html");
      # http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0cb17c10");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Adobe Flash Player version 29.0.0.140 or later."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/04/10");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/04/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/04/10");
    
      script_set_attribute(attribute:"plugin_type",value:"local");
      script_set_attribute(attribute:"cpe",value:"cpe:/a:adobe:flash_player");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("macosx_flash_player_installed.nasl");
      script_require_keys("MacOSX/Flash_Player/Version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    
    version = get_kb_item_or_exit("MacOSX/Flash_Player/Version");
    path = get_kb_item_or_exit("MacOSX/Flash_Player/Path");
    
    cutoff_version = "29.0.0.113";
    fix = "29.0.0.140";
    # We're checking for versions less than or equal to the cutoff!
    if (ver_compare(ver:version, fix:cutoff_version, strict:FALSE) <= 0)
    {
      if (report_verbosity > 0)
      {
        report =
          '\n  Path              : ' + path +
          '\n  Installed version : ' + version +
          '\n  Fixed version     : ' + fix +
          '\n';
        security_hole(port:0, extra:report);
      }
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_INST_PATH_NOT_VULN, "Flash Player for Mac", version, path);
    
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_APR_4093110.NASL
    descriptionThe remote Windows host is missing security update KB4093110. It is, therefore, affected by multiple remote code execution vulnerabilities in Adobe Flash Player.
    last seen2020-06-01
    modified2020-06-02
    plugin id108962
    published2018-04-10
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108962
    titleKB4093110: Security update for Adobe Flash Player (April 2018)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(108962);
      script_version("1.7");
      script_cvs_date("Date: 2019/05/21  6:55:12");
    
      script_cve_id(
        "CVE-2018-4932",
        "CVE-2018-4933",
        "CVE-2018-4934",
        "CVE-2018-4935",
        "CVE-2018-4936",
        "CVE-2018-4937"
      );
      script_xref(name:"MSKB", value:"4093110");
      script_xref(name:"MSFT", value:"MS18-4093110");
    
      script_name(english:"KB4093110: Security update for Adobe Flash Player (April 2018)");
      script_summary(english:"Checks the version of the ActiveX control.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host has a browser plugin installed that is
    affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update KB4093110. It is,
    therefore, affected by multiple remote code execution vulnerabilities
    in Adobe Flash Player.");
      script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/flash-player/apsb18-08.html");
      # https://support.microsoft.com/en-us/help/4093110/security-update-for-adobe-flash-player
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?08e97ef2");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released KB4093110 to address this issue."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-4935");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/04/10");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/04/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/04/10");
    
      script_set_attribute(attribute:"plugin_type",value:"local");
      script_set_attribute(attribute:"cpe",value:"cpe:/a:adobe:flash_player");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_activex_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-04";
    kbs = make_list('4093110');
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win8:'0', win81:'0', win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    if (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);
    
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    if ("Windows 8" >< productname && "Windows 8.1" >!< productname) audit(AUDIT_OS_SP_NOT_VULN);
    
    if (activex_init() != ACX_OK) audit(AUDIT_FN_FAIL, "activex_init");
    
    # Adobe Flash Player CLSID
    clsid = '{D27CDB6E-AE6D-11cf-96B8-444553540000}';
    
    file = activex_get_filename(clsid:clsid);
    if (isnull(file))
    {
      activex_end();
      audit(AUDIT_FN_FAIL, "activex_get_filename", "NULL");
    }
    if (!file)
    {
      activex_end();
      audit(AUDIT_ACTIVEX_NOT_FOUND, clsid);
    }
    
    # Get its version.
    version = activex_get_fileversion(clsid:clsid);
    if (!version)
    {
      activex_end();
      audit(AUDIT_VER_FAIL, file);
    }
    
    info = '';
    
    iver = split(version, sep:'.', keep:FALSE);
    for (i=0; i<max_index(iver); i++)
     iver[i] = int(iver[i]);
    iver = join(iver, sep:".");
    
    # all <= 29.0.0.113
    fix = FALSE;
    if(ver_compare(ver:iver, fix:"29.0.0.113", strict:FALSE) <= 0)
      fix = "29.0.0.140";
    
    if (
      (report_paranoia > 1 || activex_get_killbit(clsid:clsid) == 0) &&
      fix
    )
    {
      info = '\n  Path              : ' + file +
             '\n  Installed version : ' + version +
             '\n  Fixed version     : ' + fix +
             '\n';
    }
    
    port = kb_smb_transport();
    
    if (info != '')
    {
        if (report_paranoia > 1)
        {
          report = info +
            '\n' +
            'Note, though, that Nessus did not check whether the kill bit was\n' +
            "set for the control's CLSID because of the Report Paranoia setting" + '\n' +
            'in effect when this scan was run.\n';
        }
        else
        {
          report = info +
            '\n' +
            'Moreover, its kill bit is not set so it is accessible via Internet\n' +
            'Explorer.\n';
        }
        replace_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
        hotfix_add_report(bulletin:'MS18-04', kb:'4093110', report);
        security_report_v4(severity:SECURITY_HOLE, port:port, extra:hotfix_get_report());
    }
    else audit(AUDIT_HOST_NOT, 'affected');
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201804-11.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201804-11 (Adobe Flash Player: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, disclose sensitive information or bypass security restrictions. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id109007
    published2018-04-12
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109007
    titleGLSA-201804-11 : Adobe Flash Player: Multiple vulnerabilities
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-1119.NASL
    descriptionAn update for flash-plugin is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 29.0.0.140. Security Fix(es) : * flash-plugin: Remote Code Execution vulnerabilities (APSB18-08) (CVE-2018-4932, CVE-2018-4935, CVE-2018-4937) * flash-plugin: Information Disclosure vulnerabilities (APSB18-08) (CVE-2018-4933, CVE-2018-4934, CVE-2018-4936) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id109009
    published2018-04-12
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109009
    titleRHEL 6 : flash-plugin (RHSA-2018:1119)
  • NASL familyWindows
    NASL idFLASH_PLAYER_APSB18-08.NASL
    descriptionThe version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 29.0.0.113. It is therefore affected by multiple vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id108958
    published2018-04-10
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108958
    titleAdobe Flash Player <= 29.0.0.113 (APSB18-08)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_5C6F74823CED11E8B1576451062F0F7A.NASL
    descriptionAdobe reports : - This update resolves a use-after-free vulnerability that could lead to remote code execution (CVE-2018-4932). - This update resolves out-of-bounds read vulnerabilities that could lead to information disclosure (CVE-2018-4933, CVE-2018-4934). - This update resolves out-of-bounds write vulnerabilities that could lead to remote code execution (CVE-2018-4935, CVE-2018-4937). - This update resolves a heap overflow vulnerability that could lead to information disclosure (CVE-2018-4936).
    last seen2020-06-01
    modified2020-06-02
    plugin id108979
    published2018-04-11
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108979
    titleFreeBSD : Flash Player -- multiple vulnerabilities (5c6f7482-3ced-11e8-b157-6451062f0f7a)

Redhat

advisories
rhsa
idRHSA-2018:1119
rpmsflash-plugin-0:29.0.0.140-1.el6_9