Overview
Macromedia Flash 6 does not terminate connections when a web user leaves the page. These connections may consume excessive amounts of bandwidth and limit the flow of other data.
Description
The Macromedia Flash media format enables frame-based animations with sound to be viewed within a web browser. Flash uses a scripting language called ActionScript, which includes the commands loadMovie and loadSound to download associated video and audio clips. It is typical and generally expected for downloads of embedded web page elements to cease when a user leaves one web page for another. However, in version 6 of the Flash player plug-in for Microsoft Internet Explorer (IE), connections started by the loadMovie and loadSound commands persist after the user has left the web page containing the Flash animation. These connections remain open for downloading video or audio, which can be relatively large and exhaustive of the user's bandwidth to the Internet. |
Impact
An attacker could trick a victim into downloading a maliciously crafted Flash animation from the Web. Upon playback of the malicious animation, the victim's Flash Player software would open several multimedia connections and consume all available bandwidth, effectively making the Internet unusable until the victim closed IE. |
Solution
Update Flash Player 6 to a version later than 6,0,25,0. For more info, see: |
If you notice sluggishness in Internet connections after visiting a page containing a Flash animation, try closing IE to terminate any Flash connections. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Thanks to Dan Browder for reporting this vulnerability.
This document was written by Shawn Van Ittersum.
Other Information
| CVE IDs: | None |
| Severity Metric: | 0.86 |
| Date Public: | 2002-04-03 |
| Date First Published: | 2002-08-09 |
| Date Last Updated: | 2002-12-10 22:59 UTC |
| Document Revision: | 14 |