Adobe Flash - MovieClip Attach init Object Use-After-Free Exploit

🗓️ 15 Mar 2017 00:00:00Reported by Google Security ResearchType

zdt🔗 0day.today👁 42 Views

Adobe Flash MovieClip Use-After-Free Exploi

Reporter	Title	Published	Views	Family All 74
FreeBSD	flash -- multiple vulnerabilities	10 Jan 201700:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 7 package adobe-flash-player version 3:24-alt0.M70P.2	12 Jan 201700:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 6 package adobe-flash-player version 3:24-alt0.M70P.2	12 Jan 201700:00	–	altlinux
Tenable Nessus	Flash Player < 24.0.0.194 Multiple Vulnerabilities (APSB17-02)	12 Jan 201700:00	–	nessus
Tenable Nessus	Adobe Flash Player <= 24.0.0.186 Multiple Vulnerabilities (APSB17-02)	10 Jan 201700:00	–	nessus
Tenable Nessus	FreeBSD : flash -- multiple vulnerabilities (2a7bdc56-d7a3-11e6-ae1b-002590263bf5)	11 Jan 201700:00	–	nessus
Tenable Nessus	GLSA-201702-20 : Adobe Flash Player: Multiple vulnerabilities	21 Feb 201700:00	–	nessus
Tenable Nessus	Adobe Flash Player for Mac <= 24.0.0.186 Multiple Vulnerabilities (APSB17-02)	10 Jan 201700:00	–	nessus
Tenable Nessus	openSUSE Security Update : flash-player (openSUSE-2017-71)	12 Jan 201700:00	–	nessus
Tenable Nessus	RHEL 6 : flash-plugin (RHSA-2017:0057)	12 Jan 201700:00	–	nessus

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1006
 
The attached file causes a use-after-free in attaching a MovieClip and applying the init object.
 
 
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/41609.zip

#  0day.today [2018-01-04]  #

15 Mar 2017 00:00Current

0.2Low risk

Vulners AI Score0.2

EPSS0.64621