|
|
|
|
| |
"Macromedia Flash is the industry's most advanced authoring environment for creating interactive websites, digital experiences and mobile content."
A buffer overflow within Macromedia Flash allows attackers to execute arbitrary code with user privileges. |
| |
Credit:
The information has been provided by EEYEB.
The vendor advisory ca nbe found at: http://www.macromedia.com/devnet/security/security_zone/mpsb05-07.html
|
| |
Vulnerable Systems:
* Macromedia Flash version 6
* Macromedia Flash version 7
Immune Systems:
* Macromedia Flash version 8
The vulnerable code exists in Flash.ocx, which embodies the code responsible for playing back SWF files. One function maintains a large, 256-element table of function pointers on the stack, and uses a frame type identifier read from the SWF file as an index into the array, without enforcing the array boundaries. The following disassembly
depicts the affected code:
.text:1002714F mov eax, [esi+0CA4h] ; type number
.text:10027155 mov ecx, [esi+94h] ; base of table
.text:1002715B lea eax, [ecx+eax*8] ; get element address
.text:1002715E mov ecx, [eax] ;
Although the index is not validated, its value is elsewhere restricted to be at most 0x8000, so the attacker can cause a function pointer to be retrieved from memory up to roughly 64KB after the base of the table on the stack. Typically this range will include heap memory, so by planting specific data on the heap, the attacker can very easily control the exact value of the function pointer. Reliable exploitation using this technique within Internet Explorer has been demonstrated by eEye Digital Security.
CVE Information:
CAN-2005-2628
|
|
|
|
|
