CVE-2007-4324

{"id": "CVE-2007-4324", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-08-14T00:17:00.000", "references": [{"url": "http://kb.adobe.com/selfservice/viewContent.do?externalId=kb402956&sliceId=2", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html", "source": "cve@mitre.org"}, {"url": "http://scan.flashsec.org/", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/28157", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/28161", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/28213", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/28570", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/30507", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/32270", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/32448", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/32702", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/32759", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/33390", "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/2995", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1019116", "source": "cve@mitre.org"}, {"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1", "source": "cve@mitre.org"}, {"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1", "source": "cve@mitre.org"}, {"url": "http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm", "source": "cve@mitre.org"}, {"url": "http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm", "source": "cve@mitre.org"}, {"url": "http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=834256&poid=", "source": "cve@mitre.org"}, {"url": "http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html", "source": "cve@mitre.org"}, {"url": "http://www.adobe.com/support/security/bulletins/apsb07-20.html", "source": "cve@mitre.org"}, {"url": "http://www.adobe.com/support/security/bulletins/apsb08-18.html", "source": "cve@mitre.org"}, {"url": "http://www.gentoo.org/security/en/glsa/glsa-200801-07.xml", "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2007-1126.html", "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2008-0945.html", "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2008-0980.html", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/475961/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/25260", "source": "cve@mitre.org"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA07-355A.html", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/4258", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2008/1724/references", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2008/2838", "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11874", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "ActionScript 3 (AS3) in Adobe Flash Player 9.0.47.0, and other versions and other 9.0.124.0 and earlier versions, allows remote attackers to bypass the Security Sandbox Model, obtain sensitive information, and port scan arbitrary hosts via a Flash (SWF) movie that specifies a connection to make, then uses timing discrepancies from the SecurityErrorEvent error to determine whether a port is open or not. NOTE: 9.0.115.0 introduces support for a workaround, but does not fix the vulnerability."}, {"lang": "es", "value": "ActionScript versi\u00f3n 3 (AS3) en Adobe Flash Player versiones 9.0.47.0 y 9.0.124.0 y anteriores, permite a atacantes remotos omitir el Security Sandbox Model, obtener informaci\u00f3n confidencial y analizar puertos hosts arbitrarios por medio de una pel\u00edcula Flash (SWF) que especifica una conexi\u00f3n a realizar y, a continuaci\u00f3n, usa discrepancias de tiempo del error SecurityErrorEvent para determinar si un puerto est\u00e1 abierto o no. NOTA: la versi\u00f3n 9.0.115.0 introduce soporte para una soluci\u00f3n alternativa, pero no corrige esta vulnerabilidad."}], "lastModified": "2018-10-15T21:34:29.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0365260-6FAE-4605-BA4F-6F363EA7B565", "versionEndIncluding": "9.0.114.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}