CVE-2011-0575 in Flash Player
Summary
by MITRE
Untrusted search path vulnerability in Adobe Flash Player before 10.2.152.26 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 01/26/2025
The vulnerability identified as CVE-2011-0575 represents a critical untrusted search path issue within Adobe Flash Player versions prior to 10.2.152.26. This flaw resides in the application's dynamic link library loading mechanism, where the software fails to properly validate the source of dynamically loaded components. The vulnerability specifically manifests when Flash Player attempts to load DLL files from the current working directory without sufficient path validation, creating an environment where malicious actors can exploit this behavior to execute unauthorized code with elevated privileges.
This security weakness falls under the category of CWE-427 Uncontrolled Search Path Element, which describes situations where applications search for libraries or components in directories specified by the user or environment without proper sanitization. The vulnerability enables local privilege escalation attacks by allowing a malicious actor to place a specially crafted Trojan horse DLL in the same directory as a Flash Player executable or in a location that Flash Player searches. When the application loads this malicious component, it executes with the privileges of the Flash Player process, potentially allowing attackers to gain system-level access or perform actions beyond normal user permissions.
The operational impact of this vulnerability extends beyond simple local privilege escalation, as it can be leveraged in various attack scenarios including targeted exploitation of vulnerable systems and lateral movement within compromised networks. Attackers can craft malicious DLL files that mimic legitimate Flash Player components, making detection more challenging while maintaining the same execution privileges as the legitimate application. This vulnerability particularly affects enterprise environments where Flash Player is commonly installed and used, as it provides a straightforward path for attackers to bypass standard security controls and establish persistent access to systems.
Mitigation strategies for CVE-2011-0575 should prioritize immediate patching of affected Adobe Flash Player installations to version 10.2.152.26 or later, which contains the necessary fixes to prevent untrusted search path loading. System administrators should implement strict file permissions and access controls to limit write access to Flash Player directories, while also monitoring for suspicious DLL file placements in common working directories. Additionally, organizations should consider implementing application whitelisting policies that restrict which DLLs can be loaded by Flash Player, and deploy endpoint protection solutions that can detect and block suspicious dynamic loading behavior. The vulnerability aligns with ATT&CK technique T1055 Process Injection, as it enables attackers to inject malicious code into legitimate processes, and T1068 Local Privilege Escalation, representing a clear path to elevated system access through trusted application loading mechanisms.