U.S. Flag Official website of the Department of Homeland Security

Note: This page is part of the us-cert.gov archive.This document is part of the US-CERT website archive. These documents are no longer updated and may contain outdated information. Links may also no longer function. Please contact info@us-cert.gov if you have any questions about the US-CERT website archive.

TLP:WHITE

Alert (TA07-355A)

Adobe Updates for Multiple Vulnerabilities

Original release date: December 21, 2007

Systems Affected

  • Adobe Flash Player 9.0.48.0 and earlier
  • Adobe Flash Player 8.0.35.0 and earlier
  • Adobe Flash Player 7.0.70.0 and earlier

Overview

Adobe has released Security bulletin APSB07-20 to address multiple vulnerabilities affecting Adobe Flash Player. Attackers could exploit these vulnerabilities to execute arbitrary code, perform DNS rebinding and cross-site scripting attacks, conduct port scans, or cause a denial of service.

Description

Adobe Security Update APSB07-20 addresses a number of vulnerabilities affecting Adobe Flash 9.0.48.0 and earlier, 8.0.35.0 and earlier and 7.0.70 and earlier. Further details are available in the related vulnerability notes.

An attacker could exploit these vulnerabilities by convincing a user to load a specially crafted Flash file. Flash content is widely deployed on the internet. An attacker could distribute Flash files using web sites that allow user-supplied content, like popular social networking sites.

Impact

The impacts of these vulnerabilities vary. An attacker may be able to execute arbitrary code, perform DNS rebinding or cross-site scripting attacks, conduct port scans, or cause a denial of service.

Solution

Upgrade Flash Player

Upgrade Flash Player according to the information in Adobe Security bulletin APSB97-20. For the port scanning issue (CVE-2007-4324), consider ActionScript network socket functionality per TechNote kb402956.

Adobe provides a way to determine which version of Flash Player is installed and a way to configure notifications of updates.


References


Revision History

  • December 21, 2007: Initial release

This product is provided subject to this Notification and this Privacy & Use policy.

Was this document helpful?  Yes  |  Somewhat  |  No

Back to Top