Check Point Advisories

Macromedia Flash ActionDefineFunction Memory Access (CVE-2005-2628)

Vulnerability
Protection

Check Point Reference:	CPAI-2005-327
Date Published:	15 Jul 2010
Severity:	High
Last Updated:	Thursday 15 July, 2010
Source:
Industry Reference:	CVE-2005-2628
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	A remote code execution vulnerability exists in the Macromedia Flash plugin. The flaw is created by insufficient validation checks of user input values. This vulnerability may be exploited by a malicious user to inject and execute arbitrary code on the target host. In a successful attack, an attacker can inject code into the vulnerable target. The behavior of the target in such a case is dependent on the intention of the malicious code. If code execution is not successful, the vulnerable application may terminate as a result of the attack attempt. Note that any code executed by the attacker runs with the privileges of the logged in user.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Macromedia Flash ActionDefineFunction Memory Access protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Content Protection Violation.
Attack Information: Macromedia Flash ActionDefineFunction memory access