CVE-2008-3873

Description

The System.setClipboard method in ActionScript in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to populate the clipboard with a URL that is difficult to delete and does not require user interaction to populate the clipboard, as exploited in the wild in August 2008.

4.3

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 4.55% Top 15%

Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory sun.com Vendor Advisory opensuse.org

Affected: n/a n/a

References

Link	Tags
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=834256&poid=
http://secunia.com/advisories/33390	third party advisory
http://www.adobe.com/support/security/bulletins/apsb08-18.html
http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm
http://secunia.com/advisories/32702	third party advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/44584	vdb entry
http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html
http://blogs.adobe.com/psirt/2008/08/clipboard_attack.html
http://secunia.com/advisories/34226	third party advisory
http://www.vupen.com/english/advisories/2008/2838	vdb entry
http://blogs.zdnet.com/security/?p=1733
http://security.gentoo.org/glsa/glsa-200903-23.xml	vendor advisory
http://securitytracker.com/id?1020724	vdb entry
http://secunia.com/advisories/32759	third party advisory
http://www.redhat.com/support/errata/RHSA-2008-0945.html	vendor advisory
http://www.redhat.com/support/errata/RHSA-2008-0980.html	vendor advisory
http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm
http://www.securityfocus.com/bid/31117	vdb entry
http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1	vendor advisory
http://secunia.com/advisories/32448	third party advisory
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html	vendor advisory
http://blogs.zdnet.com/security/?p=1759

Frequently Asked Questions

What is the severity of CVE-2008-3873?: CVE-2008-3873 has been scored as a medium severity vulnerability.
How to fix CVE-2008-3873?: To fix CVE-2008-3873, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2008-3873 being actively exploited in the wild?: It is possible that CVE-2008-3873 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~5% probability that this vulnerability will be exploited by malicious actors in the next 30 days.