CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:C/I:C/A:C
EPSS
Percentile
74.6%
Incorrectly formatted sound wave (SWF) files may cause a buffer overflow in the Macromedia Flash plug-in.
If the length fields in an SWF file specify fewer data than are actually present in the file, processing the file may cause a buffer overflow in the Macromedia Flash plug-in.
The plug-in or browser may crash. Since this buffer is only read from, this overflow is unlikely to cause execution of malicious code.
While Macromedia did not produce a patch to correct this problem, it is possible that recent versions of the plug-in have corrected this problem.
475645
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: December 29, 2000 Updated: May 15, 2001
Affected
An issue has been discovered with the Macromedia Flash Player that shows a possible buffer overflow error when the player encounters a maliciously or incorrectly created SWF file. After an investigation, and consultation with the reporting engineer, Macromedia has determined the following:
* The data being accessed is located entirely in a dynamically allocated structure in the heap space of the application.
* The data access is limited to reading the information. At no time is the buffer in question ever written to. Neither the heap, nor the stack is written to during this processing, and at no time does this lead to the execution of arbitrary data as native instructions.
Given the above information, it is Macromedia’s belief that the error in question, though unfortunate, does not constitute a significant security risk. The effects of this defect are limited to the crashing of the users client (denial of service).
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23475645 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
<http://www.securityfocus.com/bid/2162>
Neal Krawetz published the intial description of this problem.
This document was last modified by Tim Shimeall
CVE IDs: | CVE-2001-0166 |
---|---|
Severity Metric: | 0.49 Date Public: |