Metasploit modules that can be used to exploit Adobe » Flash Player

Order by Disclosure Date Module Name Module Type
  • Adobe Flash Player 11.3 Kern Table Parsing Integer Overflow
    Disclosure Date: 2012-08-09
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flash_otf_font
    This module exploits a vulnerability found in the ActiveX component of Adobe Flash Player before 11.3.300.271. By supplying a specially crafted .otf font file with a large nTables value in the 'kern' header, it is possible to trigger an integer overflow, which results in remote code execution under the context of the user. This vulnerability has also been exploited in the wild in limited targeted attacks. Please note in order to ensure reliability, the exploit is forced to modify your URIPATH parameter to less than 3 characters, which may cause possible URIPATH collisions. Authors: - Alexander Gavrun - sinn3r <sinn3r@metasploit.com> - juan vazquez <juan.vazquez@metasploit.com>
  • Adobe Flash Player AVM Verification Logic Array Indexing Code Execution
    Disclosure Date: 2012-06-21
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flashplayer_arrayindexing
    This module exploits a vulnerability in Adobe Flash Player versions 10.3.181.23 and earlier. This issue is caused by a failure in the ActionScript3 AVM2 verification logic. This results in unsafe JIT(Just-In-Time) code being executed. This is the same vulnerability that was used for attacks against Korean based organizations. Specifically, this issue occurs when indexing an array using an arbitrary value, memory can be referenced and later executed. Taking advantage of this issue does not rely on heap spraying as the vulnerability can also be used for information leakage. Currently this exploit works for IE6, IE7, IE8, Firefox 10.2 and likely several other browsers under multiple Windows platforms. This exploit bypasses ASLR/DEP and is very reliable. Authors: - mr_me <steventhomasseeley@gmail.com> - Unknown
  • Adobe Flash Player Object Type Confusion
    Disclosure Date: 2012-05-04
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flash_rtmp
    This module exploits a vulnerability found in Adobe Flash Player. By supplying a corrupt AMF0 "_error" response, it is possible to gain arbitrary remote code execution under the context of the user. This vulnerability has been exploited in the wild as part of the "World Uyghur Congress Invitation.doc" e-mail attack. According to the advisory, 10.3.183.19 and 11.x before 11.2.202.235 are affected. Authors: - sinn3r <sinn3r@metasploit.com> - juan vazquez <juan.vazquez@metasploit.com>
  • Adobe Flash Player MP4 'cprt' Overflow
    Disclosure Date: 2012-02-15
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flash_mp4_cprt
    This module exploits a vulnerability found in Adobe Flash Player. By supplying a corrupt .mp4 file loaded by Flash, it is possible to gain arbitrary remote code execution under the context of the user. This vulnerability has been exploited in the wild as part of the "Iran's Oil and Nuclear Situation.doc" e-mail attack. According to the advisory, 10.3.183.15 and 11.x before 11.1.102.62 are affected. Authors: - Alexander Gavrun - sinn3r <sinn3r@metasploit.com> - juan vazquez <juan.vazquez@metasploit.com>
  • Adobe Flash Player MP4 SequenceParameterSetNALUnit Buffer Overflow
    Disclosure Date: 2011-08-09
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flash_sps
    This module exploits a vulnerability found in Adobe Flash Player's Flash10u.ocx component. When processing a MP4 file (specifically the Sequence Parameter Set), Flash will see if pic_order_cnt_type is equal to 1, which sets the num_ref_frames_in_pic_order_cnt_cycle field, and then blindly copies data in offset_for_ref_frame on the stack, which allows arbitrary remote code execution under the context of the user. Numerous reports also indicate that this vulnerability has been exploited in the wild. Authors: - Alexander Gavrun - Unknown - sinn3r <sinn3r@metasploit.com>
  • Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability
    Disclosure Date: 2011-04-11
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flashplayer_flash10o
    This module exploits a vulnerability in Adobe Flash Player that was discovered, and has been exploited actively in the wild. By embedding a specially crafted .swf file, Adobe Flash crashes due to an invalid use of an object type, which allows attackers to overwrite a pointer in memory, and results arbitrary code execution. Please note for IE 8 targets, Java Runtime Environment must be available on the victim machine in order to work properly. Authors: - sinn3r <sinn3r@metasploit.com>
  • Adobe Flash Player AVM Bytecode Verification Vulnerability
    Disclosure Date: 2011-03-15
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flashplayer_avm
    This module exploits a vulnerability in Adobe Flash Player versions 10.2.152.33 and earlier. This issue is caused by a failure in the ActionScript3 AVM2 verification logic. This results in unsafe JIT(Just-In-Time) code being executed. This is the same vulnerability that was used for the RSA attack in March 2011. Specifically, this issue results in uninitialized memory being referenced and later executed. Taking advantage of this issue relies on heap spraying and controlling the uninitialized memory. Currently this exploit works for IE6, IE7, and Firefox 3.6 and likely several other browsers. DEP does catch the exploit and causes it to fail. Due to the nature of the uninitialized memory its fairly difficult to get around this restriction. Authors: - bannedit <bannedit@metasploit.com> - Unknown
  • Adobe Flash Player "Button" Remote Code Execution
    Disclosure Date: 2010-10-28
    First seen: 2020-04-26
    exploit/windows/fileformat/adobe_flashplayer_button
    This module exploits a vulnerability in the handling of certain SWF movies within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash movie into a PDF document. An AcroJS heap spray is used in order to ensure that the memory used by the invalid pointer issue is controlled. NOTE: This module uses a similar DEP bypass method to that used within the adobe_libtiff module. This method is unlikely to work across various Windows versions due to a hardcoded syscall number. Authors: - Unknown - Haifei Li - jduck <jduck@metasploit.com>
  • Adobe Flash Player "newfunction" Invalid Pointer Use
    Disclosure Date: 2010-06-04
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flashplayer_newfunction
    This module exploits a vulnerability in the DoABC tag handling within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash movie into a PDF document. An AcroJS heap spray is used in order to ensure that the memory used by the invalid pointer issue is controlled. NOTE: This module uses a similar DEP bypass method to that used within the adobe_libtiff module. This method is unlikely to work across various Windows versions due a hardcoded syscall number. Authors: - Unknown - jduck <jduck@metasploit.com>
  • Adobe Flash Player "newfunction" Invalid Pointer Use
    Disclosure Date: 2010-06-04
    First seen: 2020-04-26
    exploit/windows/fileformat/adobe_flashplayer_newfunction
    This module exploits a vulnerability in the DoABC tag handling within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash movie into a PDF document. An AcroJS heap spray is used in order to ensure that the memory used by the invalid pointer issue is controlled. NOTE: This module uses a similar DEP bypass method to that used within the adobe_libtiff module. This method is unlikely to work across various Windows versions due a the hardcoded syscall number. Authors: - Unknown - jduck <jduck@metasploit.com>
29 metasploit modules found
1 2
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close