CVE-2010-3639 : Détail

CVE-2010-3639

38.47%V4
Network
2010-11-07
20h00 +00:00
2017-09-18
10h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE Other No informations.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 15426

Date de publication : 2010-11-04 23h00 +00:00
Auteur : Matthew Bergin
EDB Vérifié : Yes

Adobe Flash Integer Overflow Author: Matthew Bergin Date: June 15, 2010 Versions Affected: Flash10e.ocx v10.0.45.2 Flash10c.ocx v10.0.32.18 r32 Root Cause: ActionScript, "ActionIf" Affect: Denial-of-Service, possible Command Execution CVE: CVE-2010-3639 Desc: When Parsing an ActionIf ActionScript statement four args are passed to the function, an integer named i , a ubyte named ActionCode, a ushort named Length, and a short named BranchOffset. If the BranchOffset is -305 or smaller it will cause an Access Violation when reading data from a invalid memory address. The last 16-bits of the address are controlable with the size of the BranchOffset argument. Any data which is in a valid segment of memory near the controlled address can be read causing Memory Disclosure. This would be used well in combination with a memory corruption vulnerability in order to bypass ASLR. In doing my initial research I found a lot of interesting things along the way. Flash10c is not vulnerable in the same way Flash10e is. I initially discovered the integer overflow in Flash10c while fuzzing SWF. I didnt fuzz it via a web browser but instead used a free application which uses the modules in a more direct manner. Flash10c is not able to be attacked via a browser as far as I have been able to tell. However, I have found during my research that Flash10e is loaded as a module when any Flash object is encountered. I am unsure as to if this is a configuration issue or not. In addition to this, while debugging this issue I found that both versions have a self-changing CRC which inhibits keeping break points set. Another interesting note is that when confirming the PoC on Flash Movie Player i noticed that if you open the file with the File -> Open drop down menu, the PoC will not hit the vulnerable code causing a crash. However, if you register the swf extension to Flash Movie Player and "double-click" the PoC file to run it, Flash Movie Player will hit the vulnerable code every time. The PoC code would be best embedded into HTML for remote attacks but can be attacked in any manner in which Flash10c.ocx/Flash10e.ocx are loaded as modules into memory. Fuzzed Application: EolSoft Flash Movie Player (downloads.cnet.com) v1.5 Crash Details: Access Violation Exception caught at 1009cb23 mov al,[eax+ecx] EAX:0267010c EBX:00e990b4 ECX:fffffef3 EDX:00e9b038 ESI:00e80000 EDI:00e990b0 ESP:0012f780 EBP:0012f99c Reversing: struct SWFTAG Tag[7], value DoAction struct ACTIONRECORD ActionTag[6], value ActionIf, starts @ E3h size 5h int i, value 0 ubyte ActionCode, value 157 ushort Length, value 2 short BranchOffset, value -305 BranchOffset is located @ E6h-E7h PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15426.rar (adobe_flash_int_ovrflw_poc.rar)

Products Mentioned

Configuraton 0

Adobe>>Flash_player >> Version From (including) 9.0 To (excluding) 9.0.289.0

Adobe>>Flash_player >> Version From (including) 10.0 To (excluding) 10.1.102.64

Apple>>Mac_os_x >> Version -

Linux>>Linux_kernel >> Version -

Microsoft>>Windows >> Version -

Sun>>Solaris >> Version -

Configuraton 0

Adobe>>Flash_player >> Version To (including) 10.1.95.1

Google>>Android >> Version -

Références

http://www.vupen.com/english/advisories/2011/0192
Tags : vdb-entry, x_refsource_VUPEN
http://secunia.com/advisories/42183
Tags : third-party-advisory, x_refsource_SECUNIA
http://support.apple.com/kb/HT4435
Tags : x_refsource_CONFIRM
http://secunia.com/advisories/43026
Tags : third-party-advisory, x_refsource_SECUNIA
http://security.gentoo.org/glsa/glsa-201101-09.xml
Tags : vendor-advisory, x_refsource_GENTOO
http://www.vupen.com/english/advisories/2010/2918
Tags : vdb-entry, x_refsource_VUPEN
http://www.securityfocus.com/bid/44692
Tags : vdb-entry, x_refsource_BID
http://www.redhat.com/support/errata/RHSA-2010-0834.html
Tags : vendor-advisory, x_refsource_REDHAT
http://secunia.com/advisories/42926
Tags : third-party-advisory, x_refsource_SECUNIA
http://marc.info/?l=bugtraq&m=130331642631603&w=2
Tags : vendor-advisory, x_refsource_HP
http://www.vupen.com/english/advisories/2010/2903
Tags : vdb-entry, x_refsource_VUPEN
http://marc.info/?l=bugtraq&m=130331642631603&w=2
Tags : vendor-advisory, x_refsource_HP
http://www.vupen.com/english/advisories/2011/0173
Tags : vdb-entry, x_refsource_VUPEN
http://www.vupen.com/english/advisories/2010/2906
Tags : vdb-entry, x_refsource_VUPEN
http://www.redhat.com/support/errata/RHSA-2010-0867.html
Tags : vendor-advisory, x_refsource_REDHAT
http://www.redhat.com/support/errata/RHSA-2010-0829.html
Tags : vendor-advisory, x_refsource_REDHAT