CVE-2013-3362

Vulnerability

CVE-2013-3362 is a memory corruption vulnerability in Adobe Flash Player and Adobe AIR. Affected versions include Flash Player before 11.7.700.242 and 11.8.x before 11.8.800.168 on Windows and Mac OS X, before 11.2.202.310 on Linux, before 11.1.111.73 on Android 2.x and 3.x, and before 11.1.115.81 on Android 4.x; Adobe AIR before 3.8.0.1430; and Adobe AIR SDK & Compiler before 3.8.0.1430 [1]. The vulnerability is triggered via unspecified vectors, indicating a code path that can be reached through crafted content.

Exploitation

An attacker can exploit this vulnerability by delivering a specially crafted Flash (SWF) file or AIR application to a target user. No authentication is required, and the attack can be conducted remotely. The user must open the malicious file or visit a web page hosting the exploit. The exact exploitation steps are not publicly detailed, but the unspecified vectors suggest a memory corruption that can be triggered without special privileges.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the affected system or cause a denial of service (memory corruption). The attacker gains the ability to run code at the privilege level of the user running the Flash or AIR application, potentially leading to full system compromise. The impact is consistent with remote code execution and denial of service.

Mitigation

Adobe released fixed versions as listed in the vulnerability description. For Red Hat Enterprise Linux, the fix is provided via RHSA-2013:1256, updating flash-plugin to version 11.2.202.310 [1]. Users should update to the latest available versions for their platform. No workarounds are documented; the only mitigation is to apply the patch.