Vulnerabilities > CVE-2015-3113 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Adobe Flash Player
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Metasploit
| description | This module exploits a buffer overflow on Adobe Flash Player when handling nellymoser encoded audio inside a FLV video, as exploited in the wild on June 2015. This module has been tested successfully on: Windows 7 SP1 (32-bit), IE11 and Adobe Flash 18.0.0.160, Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 18.0.0.160, Windows 8.1, Firefox 38.0.5 and Adobe Flash 18.0.0.160, Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.466, and Ubuntu 14.04.2 LTS, Firefox 35.01, and Adobe Flash 11.2.202.466. Note that this exploit is effective against both CVE-2015-3113 and the earlier CVE-2015-3043, since CVE-2015-3113 is effectively a regression to the same root cause as CVE-2015-3043. |
| id | MSF:EXPLOIT/MULTI/BROWSER/ADOBE_FLASH_NELLYMOSER_BOF |
| last seen | 2020-06-13 |
| modified | 2017-07-24 |
| published | 2015-07-01 |
| references |
|
| reporter | Rapid7 |
| source | https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/browser/adobe_flash_nellymoser_bof.rb |
| title | Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow |
Nessus
NASL family Windows NASL id FLASH_PLAYER_APSB15-14.NASL description The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 18.0.0.161. It is, therefore, affected by a remote code execution vulnerability due to improper validation of unspecified user-supplied input. A remote attacker can exploit this, via specially crafted Flash content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. last seen 2020-06-01 modified 2020-06-02 plugin id 84365 published 2015-06-24 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/84365 title Adobe Flash Player <= 18.0.0.161 RCE (APSB15-14) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2015-1184.NASL description An updated Adobe Flash Player package that fixes one security issue is now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. A flaw was found in the way flash-plugin displayed certain SWF content. An attacker could use this flaw to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2015-3113) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.468. last seen 2020-06-01 modified 2020-06-02 plugin id 84391 published 2015-06-25 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/84391 title RHEL 5 / 6 : flash-plugin (RHSA-2015:1184) NASL family SuSE Local Security Checks NASL id SUSE_SU-2015-1136-1.NASL description Adobe Flash Player was updated to 11.2.202.468, fixing a security issue, where attackers could trigger a heap overflow and could execute code. https://helpx.adobe.com/security/products/flash-player/apsb15-14.html Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 84397 published 2015-06-25 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/84397 title SUSE SLED12 Security Update : flash-player (SUSE-SU-2015:1136-1) NASL family Windows NASL id SMB_KB3074219.NASL description The remote Windows host is missing KB3074219. It is, therefore, affected by a remote code execution vulnerability due to improper validation of unspecified user-supplied input. A remote attacker can exploit this, via specially crafted Flash content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. last seen 2020-06-01 modified 2020-06-02 plugin id 84367 published 2015-06-24 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/84367 title MS KB3074219: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_D02F6B011A3F11E58BD6C485083CA99C.NASL description Adobe reports : Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address a critical vulnerability (CVE-2015-3113) that could potentially allow an attacker to take control of the affected system. Adobe is aware of reports that CVE-2015-3113 is being actively exploited in the wild via limited, targeted attacks. Systems running Internet Explorer for Windows 7 and below, as well as Firefox on Windows XP, are known targets. last seen 2020-06-01 modified 2020-06-02 plugin id 84383 published 2015-06-25 reporter This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/84383 title FreeBSD : Adobe Flash Player -- critical vulnerabilities (d02f6b01-1a3f-11e5-8bd6-c485083ca99c) NASL family SuSE Local Security Checks NASL id OPENSUSE-2015-450.NASL description Adobe Flash Player was updated to 11.2.202.468 to fix one security issue. The following vulnerability was fixed : - CVE-2015-3113: A heap buffer overflow vulnerability could have allowed code execution (bsc#935701, APSB15-14) last seen 2020-06-05 modified 2015-06-26 plugin id 84416 published 2015-06-26 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/84416 title openSUSE Security Update : Adobe Flash Player (openSUSE-2015-450) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201507-13.NASL description The remote host is affected by the vulnerability described in GLSA-201507-13 (Adobe Flash Player: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 86083 published 2015-09-23 reporter This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/86083 title GLSA-201507-13 : Adobe Flash Player: Multiple vulnerabilities (Underminer) NASL family MacOS X Local Security Checks NASL id MACOSX_FLASH_PLAYER_APSB15-14.NASL description The version of Adobe Flash Player installed on the remote Mac OS X host is equal or prior to version 18.0.0.161. It is, therefore, affected by a remote code execution vulnerability due to improper validation of unspecified user-supplied input. A remote attacker can exploit this, via specially crafted Flash content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. last seen 2020-06-01 modified 2020-06-02 plugin id 84366 published 2015-06-24 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/84366 title Adobe Flash Player <= 18.0.0.161 RCE (APSB15-14) (Mac OS X) NASL family SuSE Local Security Checks NASL id SUSE_SU-2015-1137-1.NASL description Adobe Flash Player was updated to 11.2.202.468, fixing a security issue, where attackers could have triggered a heap overflow and could have executed code. <a href= last seen 2020-06-01 modified 2020-06-02 plugin id 84424 published 2015-06-26 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/84424 title SUSE SLED11 Security Update : flash-player (SUSE-SU-2015:1137-1)
Packetstorm
| data source | https://packetstormsecurity.com/files/download/132525/adobe_flash_nellymoser_bof.rb.txt |
| id | PACKETSTORM:132525 |
| last seen | 2016-12-05 |
| published | 2015-07-03 |
| reporter | juan vazquez |
| source | https://packetstormsecurity.com/files/132525/Adobe-Flash-Player-Nellymoser-Audio-Decoding-Buffer-Overflow.html |
| title | Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow |
Redhat
| advisories |
| ||||
| rpms |
|
The Hacker News
| id | THN:F7773C10A55DCB0235E45F39B23052C6 |
| last seen | 2018-01-27 |
| modified | 2015-06-25 |
| published | 2015-06-25 |
| reporter | Swati Khandelwal |
| source | https://thehackernews.com/2015/06/adobe-flash-player.html |
| title | Adobe Releases Emergency Patch for Flash Zero-Day Vulnerability |
References
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00002.html
- http://marc.info/?l=bugtraq&m=144050155601375&w=2
- http://rhn.redhat.com/errata/RHSA-2015-1184.html
- http://www.securityfocus.com/bid/75371
- http://www.securitytracker.com/id/1032696
- https://bugzilla.redhat.com/show_bug.cgi?id=1235036
- https://bugzilla.suse.com/show_bug.cgi?id=935701
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952467
- https://helpx.adobe.com/security/products/flash-player/apsb15-14.html
- https://security.gentoo.org/glsa/201507-13
- https://www.suse.com/security/cve/CVE-2015-3113.html