Adobe Flash - ATF Thumbnailing Heap Overflow Exploit

🗓️ 15 Mar 2017 00:00:00Reported by Google Security ResearchType

zdt🔗 0day.today👁 44 Views

Adobe Flash heap overflow exploit via ATF Thumbnailin

Reporter	Title	Published	Views	Family All 74
FreeBSD	flash -- multiple vulnerabilities	10 Jan 201700:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 7 package adobe-flash-player version 3:24-alt0.M70P.2	12 Jan 201700:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 6 package adobe-flash-player version 3:24-alt0.M70P.2	12 Jan 201700:00	–	altlinux
Tenable Nessus	Flash Player < 24.0.0.194 Multiple Vulnerabilities (APSB17-02)	12 Jan 201700:00	–	nessus
Tenable Nessus	Adobe Flash Player <= 24.0.0.186 Multiple Vulnerabilities (APSB17-02)	10 Jan 201700:00	–	nessus
Tenable Nessus	FreeBSD : flash -- multiple vulnerabilities (2a7bdc56-d7a3-11e6-ae1b-002590263bf5)	11 Jan 201700:00	–	nessus
Tenable Nessus	GLSA-201702-20 : Adobe Flash Player: Multiple vulnerabilities	21 Feb 201700:00	–	nessus
Tenable Nessus	Adobe Flash Player for Mac <= 24.0.0.186 Multiple Vulnerabilities (APSB17-02)	10 Jan 201700:00	–	nessus
Tenable Nessus	openSUSE Security Update : flash-player (openSUSE-2017-71)	12 Jan 201700:00	–	nessus
Tenable Nessus	RHEL 6 : flash-plugin (RHSA-2017:0057)	12 Jan 201700:00	–	nessus

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1015
 
The attached file causes an overflow in heap thumbnailing. To reproduce, place both attached files on a server and visit http://127.0.0.1/LoadImage.swf?img=thumb2.atf
 
 
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/41610.zip

#  0day.today [2018-03-19]  #

15 Mar 2017 00:00Current

8.7High risk

Vulners AI Score8.7

EPSS0.69327