Alert GCSA-06100 - Vulnerabilita' in Macromedia Flash Player di

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


******************************************************************

    Alert ID : GCSA-06100
        Data : 15 Novembre 2006
      Titolo : Vulnerabilita' in Macromedia Flash Player di Adobe (MS06-069)(923789)

******************************************************************


:: Descrizione del problema:

    Nel software Macromedia Flash Player di Adobe
    sono state individuate le seguenti cinque vulnerabilita':

    CVE-2006-3014 - Excel Embedded Shockwave Flash ActiveX Arbitrary JavaScript Execution
    CVE-2006-3311 - Buffer Overflow In Adobe Flash Player
    CVE-2006-3587 - Unspecified vulnerabilities within Adobe Flash Player prior to 9.0.16.0
    CVE-2006-3588 - Unspecified vulnerabilities within Adobe Flash Player prior to 9.0.16.0
    CVE-2006-4640 - Unspecified vulnerabilities within Adobe Flash Player prior to 9.0.16.0

    Per riuscire a sfruttarle un aggressore deve indurre l'utente a visitare
    un sito Web contenente un file SWF appositamente predisposto o inviare tale
    file come allegato di un messaggio di posta elettronica.

    Avvertenza: L'articolo della Microsoft Knowledge Base 913433 descrive
    i problemi che si potrebbero incontrare installando l'aggiornamento
    e le relative soluzioni.

    http://support.microsoft.com/?kbid=913433


:: Software interessato:

    MS Windows XP SP2
    MS Windows XP Professional x64 Edition

    Macromedia Flash Player di Adobe, versione 8.0.24.0 e precedenti


:: Impatto:

    Esecuzione di codice arbitrario in modalita' remota,
    acquisizione del controllo sul sistema.


:: Soluzioni:

    Scaricare ed applicare la patch elencata nel seguente bollettino Microsoft,
    oppure utilizzare uno degli strumenti di aggiornamento Microsoft come:
    Aggiornamenti Automatici, Windows Update, Microsoft Update,
    Windows Server Update Services, Systems Management Server.

    In alternativa aggiornare alla versione Adobe Flash Player 9.0.16.0

    http://www.adobe.com/products/flashplayer/

    Gli utenti con Flash Player installato su altre versioni del sistema
    operativo oppure che hanno scaricato Flash Player 7 o versione successiva,
    si consiglia di adottare le procedure descritte nel bollettino sulla
    sicurezza di Adobe APSB06-11:

    http://www.adobe.com/support/security/bulletins/apsb06-11.html


:: Riferimenti:

    Microsoft Security Bulletin (MS06-069)(923789)
    http://www.microsoft.com/italy/technet/security/bulletin/ms06-069.mspx

    Microsoft Security Advisory (925143)
    http://www.microsoft.com/technet/security/advisory/925143.mspx

    Microsoft Update
    https://update.microsoft.com/microsoftupdate/

    Adobe Security bulletin
    http://www.adobe.com/support/security/bulletins/apsb06-11.html

    Mitre's CVE ID:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3014
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3311
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3587
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3588
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4640

    SecurityFocus Bugtraq ID:
    http://www.securityfocus.com/bid/18583
    http://www.securityfocus.com/bid/18894
    http://www.securityfocus.com/bid/19980

    US-CERT Vulnerability Note
    http://www.kb.cert.org/vuls/id/168372
    http://www.kb.cert.org/vuls/id/451380
    http://www.kb.cert.org/vuls/id/474593

    Secunia advisories
    http://secunia.com/advisories/21865/
    http://secunia.com/advisories/21901/
    http://secunia.com/advisories/22054/
    http://secunia.com/advisories/22187/
    http://secunia.com/advisories/22882/
    http://secunia.com/advisories/21865/
    http://secunia.com/advisories/20971/

    FrSIRT
    http://www.frsirt.com/english/advisories/2006/2702
    http://www.frsirt.com/english/advisories/2006/3577
    http://www.frsirt.com/english/advisories/2006/3573
    http://www.frsirt.com/english/advisories/2006/3852
    http://www.frsirt.com/english/advisories/2006/4507

    ISS X-Force
    http://xforce.iss.net/xforce/xfdb/27312
    http://xforce.iss.net/xforce/xfdb/27601
    http://xforce.iss.net/xforce/xfdb/27602
    http://xforce.iss.net/xforce/xfdb/28886
    http://xforce.iss.net/xforce/xfdb/28887

    FortiGuard Advisory
    http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-20.html
    http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-21.html

-----BEGIN PGP SIGNATURE-----

iQCVAwUBRVsm8fOB+SpikaiRAQLuPwQAirVMq1jvA7c7kNDfs8RASW1xeHInpZ6t
7TWNPVtUpTIsca3JMpV51SV9aBkkrwc/zLveOLdU38kDJTvMKPkO4Xle2Jp1Xtuw
fOWwSp0/O0obr1UP7QZvuCD9kKl3Me3rqofK2dA1/zMQKxQMn1F4s7fgc5ZPRKGS
PqLfbRc/Z90=
=sCpz
-----END PGP SIGNATURE-----