Adobe Flash Sandbox Whitespace clickjacking

Summaryinfo

A vulnerability classified as critical has been found in Adobe Flash. Affected is an unknown function of the component Sandbox. This manipulation as part of Whitespace causes clickjacking. Furthermore, an exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Adobe Flash (Multimedia Player Software) (version now known) and classified as critical. Affected by this vulnerability is some unknown processing of the component Sandbox. The manipulation as part of a Whitespace leads to a clickjacking vulnerability. The CWE definition for the vulnerability is CWE-451. The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was published 09/27/2016 by Leone Pontorieri as not defined mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1566.003 for this issue.

A public exploit has been developed by Leone Pontorieri and been published immediately after the advisory. It is possible to download the exploit at seclists.org. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $25k-$100k. The advisory illustrates:

Flash has never fixed these issues and local-with-filesystem sandbox can be optionally enabled, by editing a configuration file. So, Flash still contains the vulnerable piece of code, but it can be exploited only if an uncommon setting is enabled. In this way, these vulnerabilities are “frozen” in the code and their fate is to be reproduced in every future version of Adobe Flash, but it seems unrealistic to use those again in a real world scenario.

Upgrading eliminates this vulnerability. The mailinglist post contains the following remark:

Like a lot of love stories, the one between Flash and local files is over. Local-with-filesystem sandbox has today, after a decade, been killed by Adobe, making (almost) obsolete those Flash files using that feature.

Similar entries are available at VDB-92243 and VDB-92244. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Multimedia Player Software

Vendor

• Adobe

Name

• Flash

License

• commercial

Website

• Vendor: https://www.adobe.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion