Think you have a false positive on this rule?

Sid 1-47531

Message

FILE-FLASH Adobe Flash Player Vector.String class out-of-bounds read attempt

Summary

This event is generated when a maliciously crafted Flash movie is detected traversing the network.

Impact

Attempted User Privilege Gain

CVE-2018-12826:

CVSS base score 7.5

CVSS impact score 3.6

CVSS exploitability score 3.9

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Detailed information

The vulnerability is caused by the computation that reads data past the end of the intended buffer; the computation is part of the ActionScript 3 VM that handles native code constructor calls. Crafted SWF input triggers the flawed computation where pointer arithmetic is not appropriately checked against boundary conditions, which leads to memory write operation through the pointer that points to an invalid memory location. The vulnerability is a result of out of range pointer offset that is used to access sub-elements of an internal data structure. An attacker can potentially leverage the vulnerability to leak sensitive data (e.g., memory addresses).

CVE-2018-12826: Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.

Affected systems

  • adobe flash_player 30.0.0.154
  • redhat enterpriselinuxdesktop 6.0
  • redhat enterpriselinuxserver 6.0
  • redhat enterpriselinuxworkstation 6.0

Ease of attack

CVE-2018-12826:

Access Vector

Access Complexity

Authentication

False positives

None known.

False negatives

None known.

Corrective action

helpx.adobe.com/security/products/flash-player/APSB18-25.html

Contributors

  • Cisco's Talos Intelligence Group

Additional References

  • helpx.adobe.com/security/products/flash-player/APSB18-25.html