FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2007-4324

This CVE name corresponds to:

Entered	Topic
2008-01-03	linux-flashplugin -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2007-4324 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2007-4324
Phase	Assigned(20070813)

Description

ActionScript 3 (AS3) in Adobe Flash Player 9.0.47.0, and other versions before 9.0.115.0, allows remote attackers to bypass the Security Sandbox Model, obtain sensitive information, and port scan arbitrary hosts via a Flash (SWF) movie that specifies a connection to make, then uses timing discrepancies from the SecurityErrorEvent error to determine whether a port is open or not.

References

Source	Reference
BUGTRAQ	20070809 Design flaw in AS3 socket handling allows port probing
MISC	http://scan.flashsec.org/
CONFIRM	http://kb.adobe.com/selfservice/viewContent.do?externalId=kb402956&sliceId=2
CONFIRM	http://www.adobe.com/support/security/bulletins/apsb07-20.html
GENTOO	GLSA-200801-07
REDHAT	RHSA-2007:1126
SUNALERT	238305
SUSE	SUSE-SA:2007:069
CERT	TA07-355A
BID	25260
FRSIRT	ADV-2007-4258
FRSIRT	ADV-2008-1724
SECTRACK	1019116
SECUNIA	28157
SECUNIA	28161
SECUNIA	28570
SECUNIA	28213
SECUNIA	30507
SREASON	2995