-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2008.0063 -- AUSCERT ALERT
                      [Win][Linux][Solaris][Mac][OSX]
              Adobe Flash player code execution vulnerability
                                28 May 2008

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              Adobe Flash Player version 9.0.124.0 and earlier
Publisher:            US-CERT
Operating System:     Windows
                      Mac OS X
                      Linux variants
                      Solaris
Impact:               Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated

Original Bulletin:    http://www.kb.cert.org/vuls/id/395473

Comment: This alert covers reports of a 0-day Adobe Flash player exploit 
         actively being exploited in the wild.
         
         Adobe is aware of the vulnerability and is working to provide a 
         solution however currently there is no patch available for this 
         issue.
         
         Avoid opening untrusted flash content.

- --------------------------BEGIN INCLUDED TEXT--------------------

Vulnerability Note VU#395473

Adobe Flash player code execution vulnerability

Overview

  Adobe Flash contains a vulnerability that may allow an attacker to run code 
  on a vulnerable system. There are reports that this vulnerability is being 
  actively exploited.

I. Description

  The Adobe Flash Player is a player for the Flash media format and enables 
  frame-based animations and multimedia to be viewed within a web browser.

  Adobe Flash Player contains an code execution vulnerability. An attacker may 
  be able to trigger this overflow by convincing a user to open a specially 
  crafted SWF file. The SWF file could be hosted or imbedded in a web page. 
  If an attacker can take control of a web site or web server, this 
  vulnerability may be exploited by trusted sites.

II. Impact

  A remoted, unauthenticated attacker may be able to execute arbitrary code.

III. Solution

  We are currently unaware of a solution to this problem.

  Workarounds for administrators

    * Ensure that security updates are applied to software running on the 
      server.
    * Reverse proxy servers and web application firewalls may be able to 
      detect and block some attacks.
    * Administrators and web developers should confirm that third parties 
      (such as ad providers) hosting content on their domain are not acting 
      as attack vectors for this vulnerability. 

  Workarounds for users

    * Using the Mozilla Firefox NoScript extension to whitelist web sites 
      that can run scripts and access installed plugins may prevent this 
      vulnerability from being exploited. Note that NoScript is not likely to 
      stop all attack vectors for this vulnerability, see the NoScript FAQ for 
      more information.

Systems Affected

  Vendor	Status	        Date Updated
  Adobe	        Vulnerable	27-May-2008

References

  http://isc.sans.org/diary.html?storyid=4465
  http://blogs.adobe.com/psirt/2008/05/potential_flash_player_issue.html
  http://www.securityfocus.com/bid/29386
  http://noscript.net/
  http://www.stopbadware.org/home/security
  http://www.owasp.org/index.php/Web_Application_Firewall
  http://ddanchev.blogspot.com/2008/05/malware-attack-exploiting-flash-zero.html

Credit

  Thanks to SANS for information that was used in this report.

  This document was written by Ryan Giobbi.

Other Information

  Date Public 05/27/2008
  Date First Published 05/27/2008 06:20:57 PM
  Date Last Updated 05/27/2008
  CERT Advisory	 
  CVE Name	 
  US-CERT Technical Alerts	 
  Metric 65.81
  Document Revision 18

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBSDy/RSh9+71yA2DNAQKXJQP/VWbWyobdhxcO+6ZJOYa0Nx4q8X8JwSYm
lzbPriMtgAUWkfPEfUpJm6/hZ2aPUetafjUl91RV/jkVjGuSZ+XysGygFEHZPDi8
sedBMrjgNcFVv1v70DI+lMjKCS+WfVeU4EQTjeWeTbMruKxfO9zpRwq4yFL+52xV
o2boW+EQUhg=
=8ucr
-----END PGP SIGNATURE-----