PT-2008-5644 · Adobe · Flash Player

Published 2008-10-17 · Updated 2018-10-30 · CVE-2008-4401

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions 9.0.124.0 and earlier

Description: The issue concerns ActionScript in Adobe Flash Player, which does not require user interaction for certain operations in the FileReference upload and download APIs. This allows remote attackers to create a browse dialog box via an SWF file, potentially having other unspecified impacts. The FileReference.browse operation in the FileReference upload API and the FileReference.download operation in the FileReference download API are specifically affected.

Recommendations: For Adobe Flash Player versions 9.0.124.0 and earlier, consider disabling the FileReference upload and download APIs until a patch is available. Restrict access to SWF files to minimize the risk of exploitation. Avoid using the FileReference.browse and FileReference.download operations in the affected APIs until the issue is resolved.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-4401

RHSA-2008:0945

RHSA-2008:0980

Affected Products

Flash Player

References · 20

• http://adobe.com/support/security/bulletins/apsb08-18.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200903-23.xml · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4401 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0945.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0980.html · Vendor Advisory
• http://secunia.com/advisories/32270 · Vendor Advisory
• http://secunia.com/advisories/33390 · Note
• http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45913 · Note
• http://secunia.com/advisories/32759 · Note
• http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm · Note
• http://secunia.com/advisories/32448 · Note
• http://secunia.com/advisories/32702 · Note