Adobe Flash - MP4 File Stack Corruption

🗓️ 17 May 2016 00:00:00Reported by Google Security ResearchType

zdt🔗 0day.today👁 41 Views

Adobe Flash MP4 File Stack Corruptio

Reporter	Title	Published	Views	Family All 103
FreeBSD	flash -- multiple vulnerabilities	12 May 201600:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 7 package adobe-flash-player version 3:11-alt62	13 May 201600:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 6 package adobe-flash-player version 3:11-alt62	13 May 201600:00	–	altlinux
Tenable Nessus	Flash Player < 11.2.202.621 / 18.0.0.352 / 21.0.0.242 Multiple Vulnerabilities (APSB16-15)	15 Jun 201600:00	–	nessus
Tenable Nessus	Google Chrome < 50.0.2661.102 Multiple Vulnerabilities	16 Jun 201600:00	–	nessus
Tenable Nessus	Adobe AIR <= 21.0.0.198 Multiple Vulnerabilities (APSB16-15)	16 May 201600:00	–	nessus
Tenable Nessus	Adobe Flash Player <= 21.0.0.226 Multiple Vulnerabilities (APSB16-15)	16 May 201600:00	–	nessus
Tenable Nessus	FreeBSD : flash -- multiple vulnerabilities (0c6b008d-35c4-11e6-8e82-002590263bf5)	20 Jun 201600:00	–	nessus
Tenable Nessus	Adobe AIR for Mac <= 21.0.0.198 Multiple Vulnerabilities (APSB16-15)	16 May 201600:00	–	nessus
Tenable Nessus	Adobe Flash Player for Mac <= 21.0.0.226 Multiple Vulnerabilities (APSB16-15)	16 May 201600:00	–	nessus

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=760
 
The attached mp4 file causes stack corruption in flash. To load, put LoadMP42.swf on a server and load http://127.0.0.1/LoadMP42.swf?file=t.mp4.
 
 
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39828.zip

#  0day.today [2018-01-09]  #

17 May 2016 00:00Current

8.8High risk

Vulners AI Score8.8

EPSS0.39664