VULNERABILITIES / FIXES - March 29, 2012

by Carol~ Moderator - 3/29/12 6:51 AM

Adobe Flash Player / AIR Two Vulnerabilities

Release Date : 2012-03-29

Criticality level : Highly critical
Impact : System access
Where : From remote
Solution Status : Vendor Patch

Software: Adobe AIR 3.x
Adobe Flash Player 11.x

Description:
Two vulnerabilities have been reported in Adobe Flash Player and Adobe AIR, which can be exploited by malicious people to compromise a user's system.

1) An error within an ActiveX Control when checking the URL security domain can be exploited to corrupt memory.

NOTE: This vulnerability affects Windows Vista and Windows 7 only.

2) An unspecified error within the NetStream class can be exploited to corrupt memory.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are reported in the following versions:
* Adobe Flash Player versions 11.1.102.63 and prior for Windows, Macintosh, Linux, and Solaris.
* Adobe Flash Player versions 11.1.111.7 and prior for Android 3.x and 2.x.
* Adobe AIR versions 3.1.0.4880 and prior for Windows, Macintosh, and Android.

Solution:
Update to a fixed version.

Provided and/or discovered by:
The vendor credits:
1) Microsoft Vulnerability Research (MSVR)
2) An anonymous person via ZDI

Original Advisory:
http://www.adobe.com/support/security/bulletins/apsb12-07.html

http://secunia.com/advisories/48623/