CVE-2007-0071

Vulnerability

An integer overflow vulnerability exists in Adobe Flash Player versions 9.0.115.0 and earlier, and 8.0.39.0 and earlier. The flaw resides in the DefineSceneAndFrameLabelData tag parsing routine within the Flash Player DLL. A crafted SWF file with a negative Scene Count value bypasses a signed comparison and is used as an offset from a NULL pointer, leading to a buffer overflow [2][4].

Exploitation

An attacker must convince a user to open a malicious SWF file, typically by hosting it on a web page or embedding it in a trusted site. No authentication is required. The attacker crafts a SWF file with a negative Scene Count value, which triggers the integer overflow when parsed. This results in memory corruption that can be leveraged to execute arbitrary code [2][4].

Impact

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary code on the victim's system with the privileges of the logged-in user. This can lead to full compromise of the affected system, including data theft, installation of malware, or further network attacks [2][4].

Mitigation

Adobe addressed this issue in Flash Player version 9.0.124.0. Users should update to the latest version available from the Adobe Flash Player Support Center. Red Hat also released an advisory (RHSA-2008-0221) for affected distributions [1][2]. No workarounds are documented; updating is the recommended action.