CVE-2002-0477

• BID:4321
• URL:http://www.securityfocus.com/bid/4321
• BUGTRAQ:20020109 Shockwave Flash player issue
• URL:http://marc.info/?l=bugtraq&m=101071988413107&w=2
• BUGTRAQ:20020319 More SWF vulnerabilities?
• URL:http://www.securityfocus.com/archive/1/262990
• CONFIRM:http://www.macromedia.com/support/flash/ts/documents/standalone_update.htm (Obsolete source - check if archived by the Wayback Machine)
• CONFIRM:http://www.macromedia.com/support/flash/ts/documents/swf_clear.htm (Obsolete source - check if archived by the Wayback Machine)
• XF:flash-fscommand-exec(8587)
• URL:http://www.iss.net/security_center/static/8587.php (Obsolete source - check if archived by the Wayback Machine)

 Christey> Is swf_clear.html *really* related to standalone_update.htm?
   Or is the former really talking about a third issue related to
   a virus?  standalone_update.htm is clearly fscommand ("exec").
   It has an "Additional information" statement that says:
   "For a description of the potential issue with the previous
   stand-alone player, please refer to [swf_clear.htm]"
   
   I interpret "the previous stand-alone player" as meaning "the player
   that we are updating with this advisory."  Since we know that
   standalone_update.htm is exec, this implies that swf_clear.htm is
   really the exec issue.  However, swf_clear.html doesn't
   mention fscommand ("exec") AT ALL, which casts doubt or at
   least uncertainty as to my conclusions.
   
   swf_clear.html links back to standalone_update.htm, so at
   least the references are circular.
   
   At least it's pretty clear that this issue is different from
   CVE-2002-0476.
   
   Email inquiry sent to Macromedia on June 13, 2002.