Collected research

More Port Scanning - This Time in Flash

Design flaw in AS3 socket handling allows port probing: Description and PoC of a Flash 9/AS 3 port scanner

David Neu and fukami · scan.flashsec.org

CVE-2007-4324. ActionScript 3 raises SecurityErrorEvent immediately for a closed TCP port but waits for a reply to its policy-file request on an open one, so the two-second delay reveals port state. A SWF scans any reachable host without DNS rebinding, one player instance per port. Fixed in Flash Player 10.

Record

Document

Design flaw in AS3 socket handling allows port probing: Description and PoC of a Flash 9/AS 3 port scanner

Researcher

David Neu and fukami

Published by

scan.flashsec.org

Topic

Other

In the archive

• Collected in the 2007 research round

Tags

• flash
• timing-attack
• side-channel
• sandbox-escape
• cve
• info-leak

This page is the archive's own catalogue record. The research is the work of David Neu and fukami, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.