Detections
Analytics
Flash Player < 9.0.289 / 10.1.102.64 Multiple Vulnerabilities (APSB10-26)
high Nessus Plugin ID 50493
Language:
Synopsis
The remote Windows host contains a browser plug-in that is affected by multiple vulnerabilities.Description
The remote Windows host contains a version of Adobe Flash Player 9.x before 9.0.289 or 10.x earlier than 10.1.102.64. Such versions are potentially affected by multiple vulnerabilities :- A memory corruption vulnerability exists that could lead to code execution. Note that there are reports that this is being actively exploited in the wild. (CVE-2010-3654)
- An input validation issue exists that could lead to a bypass of cross-domain policy file restrictions with certain server encodings. (CVE-2010-3636)
- A memory corruption vulnerability exists in the ActiveX component. (CVE-2010-3637)
- An unspecified issue exists which could lead to a denial of service or potentially arbitrary code execution. (CVE-2010-3639)
- Multiple memory corruption issues exist that could lead to arbitrary code execution. (CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, CVE-2010-3652)
- A library-loading vulnerability could lead to code execution. (CVE-2010-3976)
Solution
Upgrade to Flash Player 10.1.102.64 / 9.0.289 or later.See Also
http://www.adobe.com/support/security/bulletins/apsb10-26.html
Plugin Details
Severity: High
ID: 50493
File Name: flash_player_apsb10-26.nasl
Version: 1.22
Type: local
Agent: windows
Family: Windows
Published: 11/5/2010
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.6
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 8.1
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:adobe:flash_player
Required KB Items: SMB/Flash_Player/installed
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/4/2010
Vulnerability Publication Date: 9/10/2010
Exploitable With
CANVAS (CANVAS)
Core Impact
Metasploit (Adobe Flash Player "Button" Remote Code Execution)
Reference Information
CVE: CVE-2010-3636, CVE-2010-3637, CVE-2010-3639, CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, CVE-2010-3652, CVE-2010-3654, CVE-2010-3976