CERTA-2006-AVI-114

Vulnerability from certfr_avis - Published: - Updated:

Plusieurs vulnérabilités dans la lecture des fichiers de type flash permettent à un utilisateur mal intentionné d'exécuter du code arbitraire à distance.

Description

Plusieurs vulnérabilités critiques ont été identifiées dans les lecteurs flash permettant à un utilisateur mal intentionné de compromettre un système vulnérable au moyen d'un fichier SWF malicieusement constitué.

Contournement provisoire

  • Ne consulter que des sites Internet sans flash ou jugés de confiance ;
  • de manière générale, n'ouvrir que des fichiers SWF jugés de confiance ;
  • désinstaller flash en attendant d'installer la version corrigées puis redémarrer le naviguateur.

Il n'existe pas de méthode fiable pour désactiver temporairement le flash.

Solution

  • Mettre à jour Flash Player en version 7.0.63.0 ou en version 8.0.24.0 ;
  • mettre à jour Shockwave Player en version 10.1.1 ;
  • mettre à jour Breeze Meeting Add-In en version 7.0.55.331 (Windows) ou version 7.0.55.118 (Macintosh) ;

Dans tous les cas, se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None
Impacted products
Vendor Product Description
N/A N/A Shockwave Player version 10.1.0.11 et versions antérieures ;
N/A N/A Flash Debug Player version 7.0.14.0 et versions antérieures ;
N/A N/A Breeze Meeting Add-In version 5.1 et versions antérieures.
N/A N/A Flash Player version 8.0.22.0 et versions antérieures ;
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Shockwave Player version 10.1.0.11 et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Flash Debug Player version 7.0.14.0 et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Breeze Meeting Add-In version 5.1 et versions ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Flash Player version 8.0.22.0 et versions ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s critiques ont \u00e9t\u00e9 identifi\u00e9es dans les lecteurs\nflash permettant \u00e0 un utilisateur mal intentionn\u00e9 de compromettre un\nsyst\u00e8me vuln\u00e9rable au moyen d\u0027un fichier SWF malicieusement constitu\u00e9.\n\n## Contournement provisoire\n\n-   Ne consulter que des sites Internet sans flash ou jug\u00e9s de confiance\n    ;\n-   de mani\u00e8re g\u00e9n\u00e9rale, n\u0027ouvrir que des fichiers SWF jug\u00e9s de\n    confiance ;\n-   d\u00e9sinstaller flash en attendant d\u0027installer la version corrig\u00e9es\n    puis red\u00e9marrer le naviguateur.\n\nIl n\u0027existe pas de m\u00e9thode fiable pour d\u00e9sactiver temporairement le\nflash.\n\n## Solution\n\n-   Mettre \u00e0 jour Flash Player en version 7.0.63.0 ou en version\n    8.0.24.0 ;\n-   mettre \u00e0 jour Shockwave Player en version 10.1.1 ;\n-   mettre \u00e0 jour Breeze Meeting Add-In en version 7.0.55.331 (Windows)\n    ou version 7.0.55.118 (Macintosh) ;\n\nDans tous les cas, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour\nl\u0027obtention des correctifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-0024",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-0024"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Adobe Systems (Macromedia) APSB06-03    du 14 mars 2006 :",
      "url": "http://www.macromedia.com/devnet/security/security_zone/apsb06-03.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200603-20 du 21 mars 2006    :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200603-20.xml"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 FreeBSD pour linux-flashplugin du 15    mars 2006 :",
      "url": "http://www.vuxml.org/freebsd/pkg-linux-flashplugin.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SA:2006:015 du 21 mars 2006    :",
      "url": "http://www.novell.com/linux/security/advisories/2006_15_flashplayer.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2006:0268 du 15 mars 2006    :",
      "url": "http://rhn.redhat.com/errata/RHSA-2006-0268.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft (916208) du 14 mars 2006 :",
      "url": "http://www.microsoft.com/technet/security/advisory/916208.mspx"
    }
  ],
  "reference": "CERTA-2006-AVI-114",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-03-15T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 FreeBSD.",
      "revision_date": "2006-03-16T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 RedHat, SUSE et Gentoo.",
      "revision_date": "2006-03-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s dans la lecture des fichiers de type flash\npermettent \u00e0 un utilisateur mal intentionn\u00e9 d\u0027ex\u00e9cuter du code\narbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans Flash Player",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Secunia SA19218 du 15 mars 2006",
      "url": "http://secunia.com/advisories/19218/"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.