CVE-2008-4473: Buffer Overflow
Published Oct 17, 2008
·Updated
Multiple heap-based buffer overflows in Adobe Flash CS3 Professional on Windows and Flash MX 2004 allow remote attackers to execute arbitrary code via an SWF file containing long control parameters.
Affected Software
3 affected components
Adobe Flash Player=mx_2004
Adobe Flash Player=cs3
Microsoft Windows
Event History
Oct 17, 2008
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
Which environments are identified as affected?
The affected products named are Adobe Flash CS3 Professional on Windows and Flash MX 2004. The software field also identifies Adobe Flash Player, but no version information is provided.
2
Does an attacker need local access or authentication to exploit this issue?
No. The vulnerability is rated as network-accessible with no authentication required, and the description states that remote attackers can exploit it.
3
What is required for exploitation?
An attacker needs to provide an SWF file containing long control parameters. Successful exploitation can result in arbitrary code execution.