| VID |
50090 |
| Severity |
40 |
| Port |
139,445 |
| Protocol |
TCP |
| Class |
SMB |
| Detailed Description |
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of MP3 files. The issue lies in the failure to allocate enough space for COMM tags. An attacker could leverage this vulnerability to execute arbitrary code under the context of the current process.
* Note: This check requires an account with administrative privileges which can log into the host to scan. Absence of this condition will result in the check not being performed and a False Negative for all vulnerable hosts.
* References:
http://zerodayinitiative.com/advisories/ZDI-15-609/
https://helpx.adobe.com/security/products/flash-player/apsb15-32.html
* Platforms Affected:
Adobe Flash Player prior to 18.0.0.268
Apple Mac OS X Any version
Linux Any version
Microsoft Windows Any version |
| Recommendation |
Upgrade to the latest version of Adobe Flash Player (18.0.0.268 later), available from the Adobe Web site at http://get.adobe.com/flashplayer/ |
| Related URL |
CVE-2015-8446 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
