CVE-2013-3361

Vulnerability

CVE-2013-3361 is a memory corruption vulnerability in Adobe Flash Player and Adobe AIR. The flaw exists in Flash Player versions before 11.7.700.242 and 11.8.x before 11.8.800.168 on Windows and Mac OS X, before 11.2.202.310 on Linux, before 11.1.111.73 on Android 2.x and 3.x, and before 11.1.115.81 on Android 4.x. Adobe AIR before 3.8.0.1430 and Adobe AIR SDK & Compiler before 3.8.0.1430 are also affected. The vulnerability is triggered via unspecified vectors, likely involving crafted Flash content.

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted Flash file or visit a malicious web page hosting the exploit. No authentication or special network position is required; the attack can be delivered remotely. The exact exploitation steps are not publicly detailed, but the memory corruption can be leveraged to execute arbitrary code.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the affected application or cause a denial of service. On systems where Flash runs in a browser, this can lead to full compromise of the user's system, including data theft, installation of malware, or further network attacks.

Mitigation

Adobe released fixed versions: Flash Player 11.7.700.242, 11.8.800.168, 11.2.202.310, 11.1.111.73, and 11.1.115.81; Adobe AIR 3.8.0.1430; and Adobe AIR SDK & Compiler 3.8.0.1430. Red Hat also provided updated packages for Red Hat Enterprise Linux via RHSA-2013:1256 [1]. Users should apply updates as soon as possible. No workarounds are documented.