CVE-2015-3083

Vulnerability

Adobe Flash Player versions prior to 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X, and prior to 11.2.202.460 on Linux, along with Adobe AIR before 17.0.0.172, contain a flaw that allows remote attackers to bypass intended restrictions on filesystem write operations [1][3]. The vulnerability resides in the FlashBroker component, specifically in the BrokerCreateFile and BrokerMoveFileEx methods. These methods use CreateFile with dwShareMode set to 0, causing the call to fail if another process holds a handle to the destination folder. This failure incorrectly marks the path as valid, enabling an NTFS junction attack to write arbitrary files under user permissions [2].

Exploitation

An attacker can exploit this vulnerability by delivering a crafted SWF file to a user running a vulnerable Flash Player on Windows with Internet Explorer Protected Mode. The attack requires no authentication beyond user interaction (e.g., visiting a malicious website). The proof-of-concept demonstrates writing calc.bat to the startup folder by injecting a DLL into a low-integrity IE process with Flash Player 16.0.0.305 [2]. The attacker must set up an NTFS junction to redirect the write operation to a target location.

Impact

Successful exploitation allows an attacker to write arbitrary files to the filesystem under the user's permissions. By writing a malicious executable to the startup folder, the attacker can achieve code execution on the next system login, effectively gaining persistent access at the user privilege level [2].

Mitigation

Adobe released fixed versions on May 12, 2015: Flash Player 13.0.0.289, 17.0.0.188 (Windows/OS X), 11.2.202.460 (Linux), and AIR 17.0.0.172 [1][3]. Users should update to these versions immediately. No workaround is available [3].