----------------------------------------------------------------------

Do you need accurate and reliable IDS / IPS / AV detection rules?

Get in-depth vulnerability details:
http://secunia.com/binary_analysis/sample_analysis/

----------------------------------------------------------------------

TITLE:
Adobe Flash Player Multiple Security Issues

SECUNIA ADVISORY ID:
SA32270

VERIFY ADVISORY:
http://secunia.com/advisories/32270/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Manipulation of data

WHERE:
>From remote

SOFTWARE:
Adobe Flash Player 9.x
http://secunia.com/advisories/product/11901/

DESCRIPTION:
Some security issues have been reported in Adobe Flash Player, which
can be exploited by malicious people to bypass certain security
restrictions or manipulate certain data.

1) An error while enforcing cross-domain policy files can be
exploited to bypass certain security restrictions.

This is related to vulnerability #4 in:
SA28161

2) An ActionScript implementation error can be exploited to determine
if a port on a remote host is opened or closed.

This is related to vulnerability #8 in:
SA28161

3) The problem is that the "FileReference.browse()" and
"FileReference.download()" methods can be called without user
interaction and can potentially be used to trick a user into
downloading or uploading files.

The security issues are reported in version 9.0.124.0 and prior.

SOLUTION:
Upgrade to version 10.0.12.36. An update for the 9.x branch will
reportedly be available in early November.

PROVIDED AND/OR DISCOVERED BY:
1, 3) Reported by the vendor.
2) The vendor credits fukami of SektionEins.

ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb08-18.html

OTHER REFERENCES:
SA28161:
http://secunia.com/advisories/28161/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------