| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 4.6 | $0-$5k | 0.00 |
Summary
A vulnerability described as problematic has been identified in Adobe Flash Player up to 11.3.300.270. Affected is an unknown function. Such manipulation leads to access control. This vulnerability is traded as CVE-2014-0499. There is no exploit available. Upgrading the affected component is recommended.
Details
A vulnerability was found in Adobe Flash Player up to 11.3.300.270 (Multimedia Player Software). It has been rated as problematic. Affected by this issue is an unknown code block. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality. CVE summarizes:
Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 do not prevent access to address information, which makes it easier for attackers to bypass the ASLR protection mechanism via unspecified vectors.
The weakness was shared 02/20/2014 by Wen Guanxing with VenusTech as APSB14-07 as confirmed advisory (Website) via Zero Day Initiative (ZDI). The advisory is available at helpx.adobe.com. This vulnerability is handled as CVE-2014-0499 since 12/20/2013. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.
The vulnerability scanner Nessus provides a plugin with the ID 72606 (Flash Player <= 11.7.700.261 / 12.0.0.44 Multiple Vulnerabilities (APSB14-07)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Windows. The commercial vulnerability scanner Qualys is able to test this issue with plugin 100182 (Microsoft Windows Update for Vulnerabilities in Adobe Flash Player in Internet Explorer (KB2934802)).
Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability. Furthermore it is possible to detect and prevent this kind of attack with TippingPoint and the filter 13634.
The vulnerability is also documented in the databases at X-Force (91227), Tenable (72606), SecurityFocus (BID 65703†), Secunia (SA57057†) and Vulnerability Center (SBV-43356†). technet.microsoft.com is providing further details. The entries VDB-6601, VDB-6595, VDB-6614 and VDB-6606 are related to this item. If you want to get best quality of vulnerability data, you may have to visit VulDB.
Product
Type
Vendor
Name
Version
License
Support
Website
- Vendor: https://www.adobe.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.3VulDB Meta Temp Score: 4.6
VulDB Base Score: 5.3
VulDB Temp Score: 4.6
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Access controlCWE: CWE-264
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Unproven
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Nessus ID: 72606
Nessus Name: Flash Player <= 11.7.700.261 / 12.0.0.44 Multiple Vulnerabilities (APSB14-07)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
OpenVAS ID: 850571
OpenVAS Name: SuSE Update for flash-player openSUSE-SU-2014:0278-1 (flash-player)
OpenVAS File: 🔍
OpenVAS Family: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
TippingPoint: 🔍
McAfee IPS: 🔍
McAfee IPS Version: 🔍
ISS Proventia IPS: 🔍
PaloAlto IPS: 🔍
Fortigate IPS: 🔍
Timeline
12/20/2013 🔍02/20/2014 🔍
02/20/2014 🔍
02/20/2014 🔍
02/20/2014 🔍
02/21/2014 🔍
02/21/2014 🔍
02/22/2014 🔍
02/23/2014 🔍
06/09/2021 🔍
Sources
Vendor: adobe.comAdvisory: APSB14-07
Researcher: Wen Guanxing
Organization: VenusTech
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2014-0499 (🔍)
GCVE (CVE): GCVE-0-2014-0499
GCVE (VulDB): GCVE-100-12374
OVAL: 🔍
IAVM: 🔍
X-Force: 91227 - Adobe Flash Player information disclosure, Medium Risk
SecurityFocus: 65703 - Adobe Flash Player and AIR CVE-2014-0499 Information Disclosure Vulnerability
Secunia: 57057 - Adobe Flash Player / AIR Multiple Vulnerabilities, Extremely Critical
Vulnerability Center: 43356 - [APSB14-07] Adobe Flash Player, AIR, AIR SDK and SDK and Compiler Remote Code Execution due to a Memory Leak, Critical
Misc.: 🔍
See also: 🔍
Entry
Created: 02/22/2014 22:51Updated: 06/09/2021 17:16
Changes: 02/22/2014 22:51 (92), 05/21/2017 14:19 (3), 06/09/2021 17:16 (3)
Complete: 🔍
Cache ID: 216:5B8:103
No comments yet. Languages: en.
Please log in to comment.