CVE-2015-0337

Vulnerability

Adobe Flash Player versions prior to 13.0.0.277 on Windows and OS X, versions 14.x through 17.x prior to 17.0.0.134 on Windows and OS X, and versions prior to 11.2.202.451 on Linux are affected by a vulnerability that allows remote attackers to bypass the Same Origin Policy. The issue exists due to unspecified vectors in the Flash Player. [1][2]

Exploitation

An attacker can trigger this vulnerability by enticing a user to open a specially crafted Flash file (SWF). The attacker does not require any authentication or local access; the attack is carried out remotely by delivering the malicious content via a website or other network-based means. The exact steps are not detailed in available references, but the attack vector is through a crafted Flash file that causes the player to violate the same-origin policy. [1][2]

Impact

Successful exploitation allows the attacker to bypass the Same Origin Policy, which can lead to data theft, cross-site scripting, or other information disclosure. The attacker may gain access to data from other origins (domains) that would normally be restricted, potentially compromising user sessions or sensitive information. The privilege level obtained is that of the user running the Flash Player, typically within the browser sandbox. [1][2]

Mitigation

Adobe has released updates for Flash Player: version 13.0.0.277 (Windows/OS X), 17.0.0.134 (Windows/OS X), and 11.2.202.451 (Linux). Users should update to the latest versions immediately. Red Hat and Gentoo have provided updated packages [1][2]. No workaround is available for this vulnerability. The flaw is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.