Vulnerabilities > CVE-2018-15983 - Untrusted Search Path vulnerability in Adobe Flash Player

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL

Summary

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.

Vulnerable Configurations

Part Description Count
Application
Adobe
544
OS
Apple
1
OS
Linux
1
OS
Microsoft
3
OS
Google
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Leveraging/Manipulating Configuration File Search Paths
    This attack loads a malicious resource into a program's standard path used to bootstrap and/or provide contextual information for a program like a path variable or classpath. J2EE applications and other component based applications that are built from multiple binaries can have very long list of dependencies to execute. If one of these libraries and/or references is controllable by the attacker then application controls can be circumvented by the attacker. A standard UNIX path looks similar to this If the attacker modifies the path variable to point to a locale that includes malicious resources then the user unwittingly can execute commands on the attackers' behalf: This is a form of usurping control of the program and the attack can be done on the classpath, database resources, or any other resources built from compound parts. At runtime detection and blocking of this attack is nearly impossible, because the configuration allows execution.

Nessus

  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_NOV_4471331.NASL
    descriptionThe remote Windows host is missing security update KB4471331. It is, therefore, affected by the following vulnerabilities : - An unspecified use-after-free error exists that allows remote code execution. (CVE-2018-15982) - An unspecified insecure library loading error exists that allows privilege escalation. (CVE-2018-15983)
    last seen2020-06-01
    modified2020-06-02
    plugin id119463
    published2018-12-06
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119463
    titleKB4471331: Security update for Adobe Flash Player (December 2018)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(119463);
      script_version("1.8");
      script_cvs_date("Date: 2019/05/21  6:55:12");
    
      script_cve_id("CVE-2018-15982", "CVE-2018-15983");
      script_bugtraq_id(105909);
      script_xref(name:"MSKB", value:"4471331");
      script_xref(name:"MSFT", value:"MS18-4471331");
    
      script_name(english:"KB4471331: Security update for Adobe Flash Player (December 2018)");
      script_summary(english:"Checks the version of the ActiveX control.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host has a browser plugin installed that is
    affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote Windows host is missing security update KB4471331. It is,
    therefore, affected by the following vulnerabilities :
    
      - An unspecified use-after-free error exists that allows
        remote code execution. (CVE-2018-15982)
    
      - An unspecified insecure library loading error exists
        that allows privilege escalation. (CVE-2018-15983)");
      script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/flash-player/apsb18-42.html");
      # https://support.microsoft.com/en-us/help/4471331/security-update-for-adobe-flash-player
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?eac06564");
      script_set_attribute(attribute:"solution", value:
    "Microsoft has released KB4471331 to address this issue."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-15982");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
    
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/12/05");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/12/05");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/12/06");
    
      script_set_attribute(attribute:"plugin_type",value:"local");
      script_set_attribute(attribute:"cpe",value:"cpe:/a:adobe:flash_player");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows : Microsoft Bulletins");
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("smb_hotfixes.nasl", "ms_bulletin_checks_possible.nasl");
      script_require_keys("SMB/MS_Bulletin_Checks/Possible");
      script_require_ports(139, 445, "Host/patch_management_checks");
    
      exit(0);
    }
    
    include("audit.inc");
    include("smb_func.inc");
    include("smb_hotfixes.inc");
    include("smb_hotfixes_fcheck.inc");
    include("smb_activex_func.inc");
    
    get_kb_item_or_exit("SMB/MS_Bulletin_Checks/Possible");
    
    bulletin = "MS18-12";
    kbs = make_list('4471331');
    if (get_kb_item("Host/patch_management_checks")) hotfix_check_3rd_party(bulletin:bulletin, kbs:kbs, severity:SECURITY_HOLE);
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    get_kb_item_or_exit("SMB/WindowsVersion", exit_code:1);
    
    if (hotfix_check_sp_range(win8:'0', win81:'0', win10:'0') <= 0) audit(AUDIT_OS_SP_NOT_VULN);
    if (hotfix_check_server_core() == 1) audit(AUDIT_WIN_SERVER_CORE);
    
    productname = get_kb_item_or_exit("SMB/ProductName", exit_code:1);
    if ("Windows 8" >< productname && "Windows 8.1" >!< productname) audit(AUDIT_OS_SP_NOT_VULN);
    
    if (activex_init() != ACX_OK) audit(AUDIT_FN_FAIL, "activex_init");
    
    # Adobe Flash Player CLSID
    clsid = '{D27CDB6E-AE6D-11cf-96B8-444553540000}';
    
    file = activex_get_filename(clsid:clsid);
    if (isnull(file))
    {
      activex_end();
      audit(AUDIT_FN_FAIL, "activex_get_filename", "NULL");
    }
    if (!file)
    {
      activex_end();
      audit(AUDIT_ACTIVEX_NOT_FOUND, clsid);
    }
    
    # Get its version.
    version = activex_get_fileversion(clsid:clsid);
    if (empty_or_null(version))
    {
      activex_end();
      audit(AUDIT_VER_FAIL, file);
    }
    
    info = '';
    
    iver = split(version, sep:'.', keep:FALSE);
    for (i=0; i<max_index(iver); i++)
     iver[i] = int(iver[i]);
    iver = join(iver, sep:".");
    
    # all <= 31.0.0.153
    fix = FALSE;
    if(ver_compare(ver:iver, fix:"31.0.0.153", strict:FALSE) <= 0)
      fix = "32.0.0.101";
    
    if (
      (report_paranoia > 1 || activex_get_killbit(clsid:clsid) == 0) &&
      fix
    )
    {
      info = '\n  Path              : ' + file +
             '\n  Installed version : ' + version +
             '\n  Fixed version     : ' + fix +
             '\n';
    }
    
    port = kb_smb_transport();
    
    if (info != '')
    {
        if (report_paranoia > 1)
        {
          report = info +
            '\n' +
            'Note, though, that Nessus did not check whether the kill bit was\n' +
            "set for the control's CLSID because of the Report Paranoia setting" + '\n' +
            'in effect when this scan was run.\n';
        }
        else
        {
          report = info +
            '\n' +
            'Moreover, its kill bit is not set so it is accessible via Internet\n' +
            'Explorer.\n';
        }
        replace_kb_item(name:"SMB/Missing/"+bulletin, value:TRUE);
        hotfix_add_report(bulletin:'MS18-12', kb:'4471331', report);
        security_report_v4(severity:SECURITY_HOLE, port:port, extra:hotfix_get_report());
    }
    else audit(AUDIT_HOST_NOT, 'affected');
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FLASH_PLAYER_APSB18-42.NASL
    descriptionThe version of Adobe Flash Player installed on the remote macOS or Mac OS X host is equal or prior to version 31.0.0.153. It is therefore affected by the following vulnerabilities : - An unspecified use-after-free error exists that allows remote code execution. (CVE-2018-15982) - An unspecified insecure library loading error exists that allows privilege escalation. (CVE-2018-15983)
    last seen2020-06-01
    modified2020-06-02
    plugin id119424
    published2018-12-06
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119424
    titleAdobe Flash Player for Mac <= 31.0.0.153 (APSB18-42)
  • NASL familyWindows
    NASL idFLASH_PLAYER_APSB18-42.NASL
    descriptionThe version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 31.0.0.153. It is therefore affected by the following vulnerabilities : - An unspecified use-after-free error exists that allows remote code execution. (CVE-2018-15982) - An unspecified insecure library loading error exists that allows privilege escalation. (CVE-2018-15983)
    last seen2020-06-01
    modified2020-06-02
    plugin id119462
    published2018-12-06
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119462
    titleAdobe Flash Player <= 31.0.0.153 (APSB18-42)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_49CBE200F92A11E8A89DD43D7EF03AA6.NASL
    descriptionAdobe reports : - This update resolves a use-after-free vulnerability that could lead to arbitrary code execution (CVE-2018-15982). - This update resolves an insecure library loading vulnerability that could lead to privilege escalation (CVE-2018-15983).
    last seen2020-06-01
    modified2020-06-02
    plugin id119481
    published2018-12-07
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119481
    titleFreeBSD : Flash Player -- multiple vulnerabilities (49cbe200-f92a-11e8-a89d-d43d7ef03aa6)

The Hacker News

idTHN:1E17CFED2DC9622E7D01A332EDE9F110
last seen2018-12-06
modified2018-12-06
published2018-12-06
reporterThe Hacker News
sourcehttps://thehackernews.com/2018/12/flash-player-vulnerability.html
titleNew Adobe Flash Zero-Day Exploit Found Hidden Inside MS Office Docs