Description
ActionScript 3 (AS3) in Adobe Flash Player 9.0.47.0, and other versions and other 9.0.124.0 and earlier versions, allows remote attackers to bypass the Security Sandbox Model, obtain sensitive information, and port scan arbitrary hosts via a Flash (SWF) movie that specifies a connection to make, then uses timing discrepancies from the SecurityErrorEvent error to determine whether a port is open or not. NOTE: 9.0.115.0 introduces support for a workaround, but does not fix the vulnerability.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | flash-plugin | 9.0.115.0-1.el5 | RHSA-2008:0945, RHSA-2007:1126 |
| RHEL 4 | flash-plugin | 9.0.115.0-1.el4 | RHSA-2008:0980, RHSA-2007:1126 |
| RHEL 3 | flash-plugin | 9.0.115.0-1.el3.with.oss | RHSA-2008:0980, RHSA-2007:1126 |
Advisories 3
- RHSA-2008:0980 Red Hat Security Advisory: flash-plugin security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0945 Red Hat Security Advisory: flash-plugin security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:1126 Red Hat Security Advisory: flash-plugin security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=834256&poid=
- SUSE-SA:2007:069 vendor-advisory
- 28157 third-party-advisory
- 33390 third-party-advisory
- 2995 third-party-advisory
- 30507 third-party-advisory
- oval:org.mitre.oval:def:11874 vdb-entry signature
- http://www.adobe.com/support/security/bulletins/apsb08-18.html
- 28570 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm
- 32270 third-party-advisory
- 32702 third-party-advisory
- http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html
- ADV-2008-1724 vdb-entry
- TA07-355A third-party-advisory
- 20070809 Design flaw in AS3 socket handling allows port probing mailing-list
- GLSA-200801-07 vendor-advisory
- 25260 vdb-entry
- ADV-2008-2838 vdb-entry
- http://scan.flashsec.org/
- http://kb.adobe.com/selfservice/viewContent.do?externalId=kb402956&sliceId=2
- 28161 third-party-advisory
- RHSA-2007:1126 vendor-advisory
- 32759 third-party-advisory
- RHSA-2008:0945 vendor-advisory
- 238305 vendor-advisory
- RHSA-2008:0980 vendor-advisory
- ADV-2007-4258 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm
- 1019116 vdb-entry
- 248586 vendor-advisory
- 32448 third-party-advisory
- SUSE-SR:2008:025 vendor-advisory
- 28213 third-party-advisory
- http://www.adobe.com/support/security/bulletins/apsb07-20.html