CVE-2012-5278

Vulnerability

CVE-2012-5278 is an unspecified vulnerability in Adobe Flash Player and Adobe AIR that allows attackers to bypass intended access restrictions and execute arbitrary code. Affected versions include Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X; before 10.3.183.43 and 11.x before 11.2.202.251 on Linux; before 11.1.111.24 on Android 2.x and 3.x; before 11.1.115.27 on Android 4.x; Adobe AIR before 3.5.0.600; and Adobe AIR SDK before 3.5.0.600. The exact nature of the flaw is not publicly detailed, but it resides in the core runtime of Flash Player and AIR.

Exploitation

An attacker can exploit this vulnerability by convincing a user to view a specially crafted web page or open a malicious file (e.g., a SWF or HTML document) that triggers the flaw. No authentication or special network position is required; the attack is typically delivered via a web browser or email. The unspecified vectors likely involve memory corruption or logic errors that can be triggered without user interaction beyond opening the content.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the affected user. This can lead to full system compromise, including installation of malware, data theft, or further lateral movement within a network. The vulnerability bypasses security restrictions, giving the attacker the same privileges as the logged-in user.

Mitigation

Adobe released fixed versions in November 2012. For Red Hat Enterprise Linux, the advisory [1] provides updated packages (flash-plugin-11.2.202.251-1.el6). Users should update Flash Player to the latest versions: 10.3.183.43 or 11.5.502.110 (Windows/Mac), 11.2.202.251 (Linux), 11.1.111.24 (Android 2.x/3.x), 11.1.115.27 (Android 4.x); and Adobe AIR to 3.5.0.600. No workarounds are available; updating is the only mitigation.