PT-2006-4204 · Adobe · Flash Mx 2004+3

Stuart Pearson · Published 2006-09-12 · Updated 2018-10-18 · CVE-2006-3311

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions 8.0.24.0 and earlier Adobe Flash Professional version 8 Adobe Flash MX 2004 Adobe Flex version 1.5

Description A buffer overflow issue allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie.

Recommendations For Adobe Flash Player versions 8.0.24.0 and earlier, update to a version later than 8.0.24.0 to resolve the issue. For Adobe Flash Professional version 8, consider disabling the creation of dynamically created strings in SWF movies until a patch is available. For Adobe Flash MX 2004, restrict the use of long strings in SWF movies to minimize the risk of exploitation. For Adobe Flex version 1.5, avoid using dynamically created strings in SWF movies until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-3311

Affected Products

Flash Mx 2004

Flash Player

Flash Professional

Flex

References · 28

• 🔥 http://computerterrorism.com/research/ct12-09-2006.htm · Exploit
• http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html · Vendor Advisory
• http://adobe.com/support/security/bulletins/apsb06-11.html · Patch
• http://secunia.com/advisories/21865 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3311 · Security Note
• http://security.gentoo.org/glsa/glsa-200610-02.xml · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_53_flashplayer.html · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0674.html · Vendor Advisory
• http://vupen.com/english/advisories/2006/3577 · Note
• http://vupen.com/english/advisories/2006/4507 · Note
• http://securitytracker.com/id?1016829 · Note
• http://vupen.com/english/advisories/2006/3573 · Note
• http://secunia.com/advisories/22882 · Note
• http://kb.cert.org/vuls/id/451380 · Note