|
Macromedia Flash Media Server Administration Service Denial of Service
|
|
Secunia Advisory:
|
SA17978
|
|
|
Release Date:
|
2005-12-13
|
|
Last Update:
|
2005-12-16
|
|
Popularity:
|
6,003 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
DoS
|
|
Where:
|
From local network
|
|
Solution Status:
|
Vendor Workaround
|
|
| Software: | Macromedia Flash Media Server 1.x
Macromedia Flash Media Server 2.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
Description:
dr_insane has discovered a vulnerability in Macromedia Flash Media Server, which can be exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to an error in the Administration Service (FMSAdmin.exe) when handling received data. This can be exploited to crash the service by sending certain malformed data to port 1111/tcp.
The vulnerability has been confirmed in version 2.0 r1145 and also reported in version 1.5. Other versions may also be affected.
Solution:
The vendor recommends the following workarounds.
1) Restrict access to the Administration Service using a boundary firewall.
2) Restrict access to the Administration Service to 127.0.0.1 only using a host-based firewall.
3) Disable the Administration Service on production systems.
Provided and/or discovered by:
dr_insane
Changelog:
2005-12-16: Updated advisory with vendor recommended workarounds.
Original Advisory:
Adobe:
http://www.macromedia.com/devnet/security/security_zone/mpsb05-11.html
dr_insane:
http://www.ipomonis.com/advisories/Flash_media_server_2.txt
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
