Adobe Flash Media Server < 2.0.5 Multiple Remote Vulnerabilities

critical Nessus Plugin ID 31096

Language:

Synopsis

The remote Flash media server is affected by multiple vulnerabilities.

Description

The remote host is running Adobe's Flash Media Server, an application server for Flash-based applications.

The Edge server component included with the version of Flash Media Server installed on the remote host contains several integer overflow and memory corruption errors that can be triggered when parsing specially crafted Real Time Message Protocol (RTMP) packets. An unauthenticated, remote attacker can leverage these issues to crash the affected service or execute arbitrary code with SYSTEM-level privileges (under Windows), potentially resulting in a complete compromise of the affected host.

Solution

Upgrade to Flash Media Server 2.0.5 or later.

Plugin Details

Severity: Critical

ID: 31096

File Name: adobe_fms_2_0_5.nasl

Version: 1.22

Type: remote

Family: Gain a shell remotely

Published: 2/15/2008

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:adobe:flash_media_server

Required KB Items: rtmp/adobe_fms

Exploit Ease: No known exploits are available

Patch Publication Date: 2/12/2008

Reference Information

CVE: CVE-2007-6148, CVE-2007-6149, CVE-2007-6431

BID: 27762

CWE: 189, 399

SECUNIA: 28946

Detections

Analytics