vendor:
Flash Player
by:
Unknown, Haifei Li, jduck
7.5
CVSS
HIGH
Remote Code Execution
CWE
Product Name: Flash Player
Affected Version From: 9.x
Affected Version To: 10
Patch Exists: NO
Related CWE: CVE-2010-3654
CPE:
Metasploit:
https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0934/, https://www.rapid7.com/db/vulnerabilities/adobe-flash-apsb10-26-cve-2010-3654/, https://www.rapid7.com/db/vulnerabilities/adobe-reader-apsb10-28-CVE-2010-3654/, https://www.rapid7.com/db/vulnerabilities/apple-osx-flashplayerplugin-cve-2010-3654/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0867/, https://www.rapid7.com/db/vulnerabilities/adobe-reader-apsb10-28-cve-2010-3654/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0834/, https://www.rapid7.com/db/vulnerabilities/adobe-air-cve-2010-3654/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2010-3654/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0829/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2010-3654/
Platforms Tested:
2010
Adobe Flash Player Button Remote Code Execution
This module exploits a vulnerability in the handling of certain SWF movies within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash movie into a PDF document. An AcroJS heap spray is used in order to ensure that the memory used by the invalid pointer issue is controlled. NOTE: This module uses a similar DEP bypass method to that used within the adobe_libtiff module. This method is unlikely to work across various Windows versions due a the hardcoded syscall number.