CVE-2017-2938

Vulnerability

Adobe Flash Player versions 24.0.0.186 and earlier contain a security bypass vulnerability related to handling TCP connections [1]. The flaw exists in the way the player processes network connections, allowing an attacker to bypass security restrictions. The affected versions are those prior to 24.0.0.194, which was released as a fix [1].

Exploitation

An attacker must craft a malicious SWF file and deliver it to a victim, typically via a web page or email. No authentication is required; the victim only needs to load the SWF content. The exploitation involves the SWF file triggering the vulnerability during TCP connection handling, leading to a security bypass [1][2].

Impact

Successful exploitation allows an attacker to bypass security restrictions, potentially resulting in the disclosure of sensitive information. The CVSS v3 base score is 6.5 (Medium), indicating a moderate impact on confidentiality [1]. The Red Hat advisory notes that this vulnerability is part of a set that could also lead to arbitrary code execution or denial of service, but for this specific CVE, the primary impact is security bypass [1].

Mitigation

The vulnerability is fixed in Adobe Flash Player version 24.0.0.194, released on 2017-01-11 [1]. Users should update to the latest version. For Red Hat Enterprise Linux 6, the update is available via RHSA-2017-0057 [1]. Gentoo users should upgrade to >=www-plugins/adobe-flash-24.0.0.221 [2]. No workaround is available.