RHEL 5/6:flash-plugin (RHSA-2015:1214)

critical Nessus 插件 ID 84631
全新!插件严重性现在使用 CVSS v3

计算的插件严重性默认已更新为使用 CVSS v3。没有 CVSS v3 分数的插件将回退到 CVSS v2 来计算严重性。可以在设置下拉列表中切换严重性显示首选项。

简介

远程 Red Hat 主机缺少安全更新。

描述

更新后的 Adobe Flash Player 程序包修复了多个安全问题,现在可用于 Red Hat Enterprise Linux 5 和 6 Supplementary。

Red Hat 产品安全团队将此更新评级为具有严重安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数,其给出了详细的严重性等级。

Flash 插件程序包包含兼容 Mozilla Firefox 的 Adobe Flash Player Web 浏览器插件。

此更新修复了 Adobe Flash Player 中的多种漏洞。
请参阅“参考”部分的 Adobe 安全公告 APSB15-16,了解这些漏洞的详情。

在 Flash 插件显示某些 SWF 内容的方式中发现多种缺陷。攻击者可利用这些缺陷创建特别构建的 SWF 文件,当受害者加载包含恶意 SWF 内容的页面时,可导致 Flash 插件崩溃,或可能执行任意代码。(CVE-2015-3117、CVE-2015-3118、CVE-2015-3119、CVE-2015-3120、CVE-2015-3121、CVE-2015-3122、CVE-2015-3123、CVE-2015-3124、CVE-2015-3126、CVE-2015-3127、CVE-2015-3128、CVE-2015-3129、CVE-2015-3130、CVE-2015-3131、CVE-2015-3132、CVE-2015-3133、CVE-2015-3134、CVE-2015-3135、CVE-2015-3136、CVE-2015-3137、CVE-2015-4428、CVE-2015-4429、CVE-2015-4430、CVE-2015-4431、CVE-2015-4432、CVE-2015-4433、CVE-2015-5117、CVE-2015-5118、CVE-2015-5119)

在 Flash 插件中发现多个安全绕过缺陷,可导致泄露敏感信息。(CVE-2014-0578、CVE-2015-3114、CVE-2015-3115、CVE-2015-3116、CVE-2015-3125、CVE-2015-5116)

所有 Adobe Flash Player 用户应安装此更新后的程序包,将 Flash Player 升级到版本 11.2.202.481。

解决方案

更新受影响的 flash-plugin 程序包。

另见

https://helpx.adobe.com/security/products/flash-player/apsb15-16.html

https://helpx.adobe.com/security/products/flash-player/apsa15-03.html

https://access.redhat.com/errata/RHSA-2015:1214

https://access.redhat.com/security/cve/cve-2015-4429

https://access.redhat.com/security/cve/cve-2015-4428

https://access.redhat.com/security/cve/cve-2015-3121

https://access.redhat.com/security/cve/cve-2015-3120

https://access.redhat.com/security/cve/cve-2015-3123

https://access.redhat.com/security/cve/cve-2015-3122

https://access.redhat.com/security/cve/cve-2015-3125

https://access.redhat.com/security/cve/cve-2015-3124

https://access.redhat.com/security/cve/cve-2015-3127

https://access.redhat.com/security/cve/cve-2015-3126

https://access.redhat.com/security/cve/cve-2015-3129

https://access.redhat.com/security/cve/cve-2015-3128

https://access.redhat.com/security/cve/cve-2015-5118

https://access.redhat.com/security/cve/cve-2015-5119

https://access.redhat.com/security/cve/cve-2015-5116

https://access.redhat.com/security/cve/cve-2015-5117

https://access.redhat.com/security/cve/cve-2014-0578

https://access.redhat.com/security/cve/cve-2015-4432

https://access.redhat.com/security/cve/cve-2015-4433

https://access.redhat.com/security/cve/cve-2015-4430

https://access.redhat.com/security/cve/cve-2015-4431

https://access.redhat.com/security/cve/cve-2015-3118

https://access.redhat.com/security/cve/cve-2015-3119

https://access.redhat.com/security/cve/cve-2015-3114

https://access.redhat.com/security/cve/cve-2015-3115

https://access.redhat.com/security/cve/cve-2015-3116

https://access.redhat.com/security/cve/cve-2015-3117

https://access.redhat.com/security/cve/cve-2015-3132

https://access.redhat.com/security/cve/cve-2015-3133

https://access.redhat.com/security/cve/cve-2015-3130

https://access.redhat.com/security/cve/cve-2015-3131

https://access.redhat.com/security/cve/cve-2015-3136

https://access.redhat.com/security/cve/cve-2015-3137

https://access.redhat.com/security/cve/cve-2015-3134

https://access.redhat.com/security/cve/cve-2015-3135

https://access.redhat.com/security/cve/cve-2015-5124

插件详情

严重性: Critical

ID: 84631

文件名: redhat-RHSA-2015-1214.nasl

版本: 2.25

类型: local

代理: unix

发布时间: 2015/7/9

最近更新时间: 2021/2/5

依存关系: ssh_get_info.nasl

风险信息

VPR

风险因素: Critical

分数: 9.8

CVSS v2

风险因素: Critical

基本分数: 10

时间分数: 7.8

矢量: AV:N/AC:L/Au:N/C:C/I:C/A:C

时间矢量: E:POC/RL:OF/RC:C

漏洞信息

CPE: p-cpe:/a:redhat:enterprise_linux:flash-plugin, cpe:/o:redhat:enterprise_linux:5, cpe:/o:redhat:enterprise_linux:6, cpe:/o:redhat:enterprise_linux:6.6

必需的 KB 项: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

可利用: true

易利用性: Exploits are available

补丁发布日期: 2015/7/8

漏洞发布日期: 2015/7/8

可利用的方式

CANVAS (CANVAS)

Core Impact

Metasploit (Adobe Flash Player ByteArray Use After Free)

参考资料信息

CVE: CVE-2014-0578, CVE-2015-3114, CVE-2015-3115, CVE-2015-3116, CVE-2015-3117, CVE-2015-3118, CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-3123, CVE-2015-3124, CVE-2015-3125, CVE-2015-3126, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3130, CVE-2015-3131, CVE-2015-3132, CVE-2015-3133, CVE-2015-3134, CVE-2015-3135, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4429, CVE-2015-4430, CVE-2015-4431, CVE-2015-4432, CVE-2015-4433, CVE-2015-5116, CVE-2015-5117, CVE-2015-5118, CVE-2015-5119, CVE-2015-5124

BID: 75590, 75591, 75592, 75593, 75595, 75596

RHSA: 2015:1214