Adobe Flash Player Multiple Vulnerabilities

SA40907

CVE-2010-0209, CVE-2010-2188, CVE-2010-2213, CVE-2010-2214, CVE-2010-2215, CVE-2010-2216

11 Aug 2010

Highly Critical

Vendor Patch

Adobe AIR 2.x
Adobe Flash CS3
Adobe Flash CS4
Adobe Flash Player 10.x
Adobe Flash Professional CS5
Adobe Flex 3.x
Adobe Flex 4.x

From remote

System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Multiple vulnerabilities have been reported in Adobe Flash Player, which can be exploited by malicious people to conduct click-jacking attacks or compromise a user's system.

1) An error in the ActionScript Virtual Machine 1 (AVM1) when handling the "ActionPush" command can be exploited to corrupt memory.

2) Unspecified errors can be exploited to corrupt memory. No more information is currently available.

3) An unspecified error can be exploited to corrupt memory. No more information is currently available.

4) An error in the "connect" method exposed via ActionScript native object number 2200 can be exploited to corrupt memory by calling the method several times with differing strings.

5) An unspecified error can be exploited to corrupt memory. No more information is currently available.

Successful exploitation of vulnerabilities #1 through #5 may allow execution of arbitrary code.

6) A click-jacking error can be exploited to trick a user into performing unintended actions.

Update to a fixed version.

Flash Player 10.1.53.64 and earlier:
Update to version 10.1.82.76 or later.
http://www.adobe.com/go/getflash

Flash Player 10.1.53.64 and earlier - network distribution:
Update to version 10.1.82.76 or later.
http://www.adobe.com/licensing/distribution

AIR 2.0.2.12610:
Update to version 2.0.3 or later.
http://get.adobe.com/air

Flash Professional CS5, Flash CS4 Professional and Flex 4:
Update to version 10.1.82.76 or later.
http://www.adobe.com/support/flashplayer/downloads.html#fp10

Flash CS3 Professional and Flex 3:
Update to version 9.0.280 or later.
http://www.adobe.com/support/flashplayer/downloads.html#fp9

1) Will Dormann, CERT/CC.
2,3) The vendor credits Will Dormann, CERT/CC.
4) Damian Put, reported via ZDI.
5) The vendor credits Lenovo Security Technologies (Beijing).
6) The vendor credits Jöran Benker.

Adobe:
http://www.adobe.com/support/security/bulletins/apsb10-16.html

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-149

US-CERT VU#660993:
http://www.kb.cert.org/vuls/id/660993