A vulnerability, which was classified as critical, has been found in Adobe Flash (Multimedia Player Software) (the affected version is unknown). This issue affects an unknown code of the component Sandbox. The manipulation as part of a Percent-Encoding leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability.

The weakness was presented 09/27/2016 by Leone Pontorieri as not defined mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

A public exploit has been developed by Leone Pontorieri and been published immediately after the advisory. The exploit is available at seclists.org. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $25k-$100k. The code used by the exploit is:

navigateToURL(new URLRequest("file:///tmp/%61ttack%2Dthis-sandbox.html"));

Flash has never fixed these issues and local-with-filesystem sandbox can be optionally enabled, by editing a configuration file. So, Flash still contains the vulnerable piece of code, but it can be exploited only if an uncommon setting is enabled. In this way, these vulnerabilities are “frozen” in the code and their fate is to be reproduced in every future version of Adobe Flash, but it seems unrealistic to use those again in a real world scenario.

Upgrading eliminates this vulnerability. The mailinglist post contains the following remark:

Like a lot of love stories, the one between Flash and local files is over. Local-with-filesystem sandbox has today, after a decade, been killed by Adobe, making (almost) obsolete those Flash files using that feature.

See 92244 and 92245 for similar entries.

Productinfo

Type

• Multimedia Player Software

Vendor

• Adobe

Name

• Flash

License

• commercial

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion