header-logo
Suggest Exploit
vendor:
Flash Player
by:
Google Security Research
9.3
CVSS
HIGH
Integer Overflow
190
CWE
Product Name: Flash Player
Affected Version From: All versions
Affected Version To: All versions
Patch Exists: YES
Related CWE: CVE-2015-7645
CPE: o:adobe:flash_player
Metasploit: https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2015-2024/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2015-1913/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2015-7645/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2015-7645/, https://www.rapid7.com/db/vulnerabilities/adobe-flash-apsb15-27-cve-2015-7645/
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: 64-bit platforms
2015

Integer Overflow

An integer overflow vulnerability exists in Adobe Flash Player when processing an MP3 file with a large ID3 tag. This vulnerability can be exploited by an attacker to cause a buffer overflow, resulting in arbitrary code execution. The vulnerability affects all versions of Adobe Flash Player on 64-bit platforms.

Mitigation:

Adobe has released a patch to address this vulnerability.
Source

Exploit-DB raw data:

Source: https://code.google.com/p/google-security-research/issues/detail?id=443&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

If an mp3 file contains compressed ID3 data that is larger than 0x2aaaaaaa bytes, an integer overflow will occur in allocating the buffer to contain its converted string data, leading to a large copy into a small buffer. A sample fla, swf and mp3 are attached. Put id34.swf and tag.mp3 in the same folder to reproduce the issue. This issue only works on 64 bit platforms.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37882.zip

Navigation

Suggest Exploit

Services By CQR