A
third Adobe Flash Player zero-day has been discovered since the HackingTeam breach. Thanks to the breach of the
Hacking Team‘s private files, the third Adobe Flash zero-day has been made publicly accessible.
“After two Adobe Flash player zero-days disclosed in a row from the leaked data of Hacking Team, we discovered another Adobe Flash Player zero-day (assigned with CVE number, CVE-2015-5123) that surfaced from the said leak. Adobe has already released a security advisory after we reported the said zero-day. This vulnerability is rated as critical and can allow an attacker to take control of the affected system once successfully exploited. It affects all versions of Adobe Flash in Windows, Mac, and Linux.” reported a blog post from Trend Micro.
This newly uncovered zero-day has a similar PoC as the one released immediately prior (CVE-2015-5122), but has not yet been added to the arsenals of any active exploit kits.This new zero-day affects Adobe Flash Player up to version 18.0.0.203.
Differently from previously reported Flash zero-day exploits, it involves the BitmapData object and not the TextLine and ByteArray.
The vulnerability can be triggered by the following steps:
- From a new BitmapData object, prepare two Array objects, new two MyClass objects, and assign theMyClass object to each Array objects.
- Once the valueOf function of MyClass is override, it calls the BitmapData.paletteMap with the two Arrayobjects as parameters. The BitmapData.paletteMap will trigger the valueOf function.
- In the valueOf function, it will call BitmapData.dispose() to dispose the underlying memory of BitmapDataobject, thus causing Flash Player to crash.
The experts at Trend Micro are monitoring the proof-of-concept (POC) for any active attacks that may employ this vulnerability.
Adobe has since updated their previously released security bulletin and expects to patch this vulnerability, along with
CVE-2015-5122, at some point during this coming week.
Special Thanks
About the Author Michael Fratello
Michael Fratello is a Security Engineer employed by CipherTechs, Inc., a privately held information security services provider located in downtown Manhattan, New York. Specializing in Penetration Testing and Digital Forensics, Michael, a St. John’s University graduate majoring in Computer Security Systems, has developed a passion for information security and often spends his free time studying, programming, and researching the exponentially growing number of threats found in-the-wild today.
Edited by Pierluigi Paganini
(Security Affairs – Hacking Team, zero-day)
Pierluigi Paganini
July 14, 2015
