#VU3107 Cross-site scripting in Adobe Flash Player and Adobe AIR - CVE-2010-2179

Vulnerability identifier: #VU3107

Vulnerability risk: High

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Amber]

CVE-ID: CVE-2010-2179

CWE-ID: CWE-79

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Adobe Flash Player
Client/Desktop applications / Plugins for browsers, ActiveX components
Adobe AIR
Client/Desktop applications / Multimedia software

Vendor: Adobe

Description

The vulnerability allows a remote attacker to conduct XSS attacks.

The vulnerability exists due to improper URL parsing. A remote attacker can create a specially crafted link, trick the victim into opening it and execute arbitrary HTML and scrip code in victim's browser in context of arbitrary website.

Successful exploitation of the vulnerability may result in successful cross-site scripting attack against any website with .swf file.

The vulnerability can be exploited against Firefox and Chrome browsers only.

Mitigation
Install the latest version from vendor's website. The vulnerability is fixed in the following versions:

• Flash Player 10.1.53.64
• AIR 2.0.2.12610
• Flash Professional CS5 10.1.53.64
• Flash CS4 Professional and Flex 4 10.1.53.64
• Flash CS3 Professional and Flex 3 9.0.277.0

Vulnerable software versions

Adobe Flash Player: 9.0.124.0 - 10.0.45.2

Adobe AIR: 1.5.0.7220 - 1.5.3.9130

---

External links
https://www.adobe.com/support/security/bulletins/apsb10-14.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.