|
|
Macromedia Flash未公开action操作访问文件漏洞
发布时间：2002-03-22
更新时间：2002-03-22
严重程度：中
威胁程度：普通用户访问权限
错误类型：设计错误
利用方式：客户机模式
BUGTRAQ ID：4321
受影响系统Macromedia Flash 5.0
- Microsoft Windows 2000 Advanced Server 0.0
- Microsoft Windows 2000 Advanced Server 0.0SP1
- Microsoft Windows 2000 Advanced Server 0.0SP2
- Microsoft Windows 2000 Professional 0.0
- Microsoft Windows 2000 Professional 0.0SP1
- Microsoft Windows 2000 Professional 0.0SP2
- Microsoft Windows 2000 Server 0.0
- Microsoft Windows 2000 Server 0.0SP1
- Microsoft Windows 2000 Server 0.0SP2
- Microsoft Windows 95 0.0
- Microsoft Windows 95 0.0SR2
- Microsoft Windows 98 0.0
- Microsoft Windows 98SE 0.0
- Microsoft Windows ME 0.0
- Microsoft Windows NT Enterprise Server 4.0
- Microsoft Windows NT Enterprise Server 4.0SP1
- Microsoft Windows NT Enterprise Server 4.0SP2
- Microsoft Windows NT Enterprise Server 4.0SP3
- Microsoft Windows NT Enterprise Server 4.0SP4
- Microsoft Windows NT Enterprise Server 4.0SP5
- Microsoft Windows NT Enterprise Server 4.0SP6
- Microsoft Windows NT Enterprise Server 4.0SP6a
- Microsoft Windows NT Server 4.0
- Microsoft Windows NT Server 4.0SP1
- Microsoft Windows NT Server 4.0SP2
- Microsoft Windows NT Server 4.0SP3
- Microsoft Windows NT Server 4.0SP4
- Microsoft Windows NT Server 4.0SP5
- Microsoft Windows NT Server 4.0SP6
- Microsoft Windows NT Server 4.0SP6a
- Microsoft Windows NT Workstation 4.0
- Microsoft Windows NT Workstation 4.0SP1
- Microsoft Windows NT Workstation 4.0SP2
- Microsoft Windows NT Workstation 4.0SP3
- Microsoft Windows NT Workstation 4.0SP4
- Microsoft Windows NT Workstation 4.0SP5
- Microsoft Windows NT Workstation 4.0SP6
- Microsoft Windows NT Workstation 4.0SP6a
- Microsoft Windows XP Home 0.0
- Microsoft Windows XP Professional 0.0 详细描述
Flash存在一个漏洞允许远程用户访问本地系统文件。未公开的FSCommand 'exe'操作用来执行外部应用程序，为了利用这个命令需要指定请求应用程序的绝对路径，通过另外一个FLASH可写文件到系统的漏洞，可导致任意命令可执行。
测试代码
尚无
解决方案
补丁下载：
Macromedia Flash 5.0:
Macromedia Patch flashplayer_updater
http://download.macromedia.com/pub/flashplayer/updaters/5/flashplayer_updater.zip
相关信息
Vengy <cyber_flash@hotmail.com>
参考：http://online.securityfocus.com/archive/1/262990
http://www.macromedia.com/support/flash/ts/documents/fs_save.htm
http://www.macromedia.com/support/flash/ts/documents/standalone_update.htm
http://www.europe.f-sec
|
