Adobe Flash Player Multiple Vulnerabilities

SECUNIA ID : SA34012
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CVE-ID : CVE-2009-0519 , CVE-2009-0520 , CVE-2009-0521 , CVE-2009-0522
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
RELEASED DATE : 25 FEB 2009

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CRITICALITY : Highly Critical
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SOLUTION STATUS : VENDOR PATCH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SOFTWARE :

• 
  
• 
  
• 
  
• 
  
• 
  

• Adobe AIR 1.x
• Adobe Flash CS3
• Adobe Flash CS4
• Adobe Flash Player 10.x
• Adobe Flash Player 9.x
• Adobe Flex 3.x

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
WHERE : From remote
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
IMPACT :

System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Exposure of sensitive information

Vulnerabilities where documents or credentials are leaked or can be revealed either locally or from remote.

Privilege escalation

This covers vulnerabilities where a user is able to conduct certain tasks with the privileges of other users or administrative users.

This typically includes cases where a local user on a client or server system can gain access to the administrator or root account thus taking full control of the system.

Security Bypass

This covers vulnerabilities or security issues where malicious users or people can bypass certain security mechanisms of the application.

The actual impact varies significantly depending on the design and purpose of the affected application.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

DESCRIPTION :

Some vulnerabilities have been reported in Adobe Flash Player, which can be exploited by malicious, local users to disclose sensitive information and potentially gain escalated privileges, and by malicious people to bypass certain security restrictions, disclose potentially sensitive information, and compromise a user's system.

1) An error when processing multiple references to an unspecified object can be exploited to dereference freed memory via a specially crafted SWF file.

Successful exploitation allows execution of arbitrary code.

2) An input validation error in the processing of SWF files can be exploited to cause a crash and potentially execute arbitrary code.

3) An error when displaying the mouse pointer on Windows can be exploited to potentially conduct "Clickjacking" attacks.

4) An error in the Linux Flash Player binary can be exploited to disclose sensitive information and potentially gain escalated privileges.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SOLUTION :

Apply vendor updates.

Flash Player 9.x:
Update to version 9.0.159.0.
http://www.adobe.com/go/kb406791

Flash Player 10.0.12.36 and prior:
Update to version 10.0.22.87.
http://www.adobe.com/go/getflash

Flash Player 10.0.12.36 and prior (network distribution):
Update to version 10.0.22.87.
http://www.adobe.com/licensing/distribution

Flash Player 10.0.15.3 and prior for Linux:
Update to version 10.0.22.87.
http://www.adobe.com/go/getflash

AIR 1.5:
Update to version 1.5.1.
http://get.adobe.com/air

Flash CS4 Professional:
Update to version 10.0.22.87.
http://www.adobe.com/support/flashplayer/downloads.html#fp10

Flash CS3 Professional:
Update to version 9.0.159.0.
http://www.adobe.com/support/flashplayer/downloads.html#fp9

Flex 3:
Update to version 10.0.22.87.
http://www.adobe.com/support/flashplayer/downloads.html#fp9

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
REPORTED BY :

1) Javier Vicente Vallejo, reported via iDefense
2) The vendor credits Roee Hay from IBM Rational Application Security.
3) The vendor credits Eduardo Vela.
4) The vendor credits Josh Bressers of Red Hat and Tavis Ormandy of the Google Security Team.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ORIGINAL ADVISORY :

Adobe:
http://www.adobe.com/support/security/bulletins/apsb09-01.html

iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=773

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
TAKEN FROM : http://www.viruslist.com/en/advisories/34012
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~