CVE-2014-0506

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player before versions 11.7.700.275 and 13.0.0.182 on Windows and OS X, and before 11.2.202.350 on Linux. It also affects Adobe AIR before 13.0.0.83 on Android, and AIR SDK/SDK & Compiler before 13.0.0.83. The flaw is triggered via unspecified vectors involving a specially crafted SWF file [1][2].

Exploitation

An attacker can exploit this remotely by enticing a user to open a malicious SWF file in an affected Flash Player instance. No authentication is required, and the attack does not require any special network position beyond standard web delivery. As demonstrated by VUPEN during the Pwn2Own competition at CanSecWest 2014, the exploit can bypass Internet Explorer sandbox protections [1].

Impact

Successful exploitation leads to arbitrary code execution in the context of the user running the Flash Player. This can result in full compromise of the affected system, including potential privilege escalation and bypass of browser sandbox mechanisms [1][2].

Mitigation

Adobe released fixed versions: Flash Player 11.7.700.275 and 13.0.0.182 for Windows/OS X, 11.2.202.350 for Linux, and AIR 13.0.0.83 for Android. Red Hat provided updates via RHSA-2014:0380 for Red Hat Enterprise Linux [1], Gentoo issued GLSA 201405-04 [2]. Users should update immediately; no workaround is available.