PT-2004-3229 · Macromedia+1 · Director+7

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2335

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Macromedia Contribute 2, Director, Dreamweaver, Fireworks, Flash, and Studio (affected versions not specified)

Description: The issue concerns the Macromedia installers and e-licensing client on Mac OS X. It allows local users to gain privileges by modifying the AuthenticationService program, which is installed setuid and is writable by other users.

Recommendations: For the affected Macromedia products, consider restricting access to the AuthenticationService program until a fix is available. As a temporary workaround, consider disabling the setuid bit on the AuthenticationService program to prevent unauthorized modifications. Restrict write access to the AuthenticationService program to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-2335

Affected Products

Authenticationservice

Director

Dreamweaver

Fireworks

Flash

Macos X

Macromedia Contribute

Studio

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2004-2335 · Security Note
• http://macromedia.com/devnet/security/security_zone/mpsb04-03.html · Vendor Advisory
• http://securityfocus.com/bid/9862 · Patch
• http://secunia.com/advisories/11123 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15465 · Note