CVE-2015-3089

Vulnerability

CVE-2015-3089 is a memory corruption vulnerability in Adobe Flash Player, affecting versions before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X, before 11.2.202.460 on Linux, as well as Adobe AIR before 17.0.0.172 and related SDKs [1][3]. The bug occurs when Flash processes a crafted MPD file, leading to an uninitialized stack variable that corrupts memory [2]. This is one of several similar vulnerabilities disclosed at the same time (CVE-2015-3078, CVE-2015-3090, CVE-2015-3093) [1][3].

Exploitation

An attacker can exploit this vulnerability by hosting a malicious SWF file along with a specially crafted MPD file on a web server [2]. The user must visit the malicious page, typically via a browser. The proof-of-concept uses a compiled ActionScript file with specific Flex flags (-target-player 14.0 -swf-version 25) and loads the MPD file via PlayManifest.swf?file=gen.mpd [2]. No authentication or prior access is required. The crash analysis shows a null pointer dereference due to an uninitialized stack variable, which an attacker could leverage for code execution [2].

Impact

Successful exploitation results in memory corruption, allowing an attacker to execute arbitrary code with the privileges of the user running Flash Player, or cause a denial of service [1][3]. If the user has administrative rights, the attacker could gain full system control. The vulnerability can also lead to information disclosure or security restriction bypass [3].

Mitigation

Adobe released fixed versions on May 12, 2015: Flash Player 13.0.0.289, 17.0.0.188 (Windows/OS X), 11.2.202.460 (Linux), and AIR 17.0.0.172 [1]. Users should update immediately via the Adobe website or automatic update mechanisms. No workarounds are available [3]. Red Hat and Gentoo advisories both recommend upgrading to the patched versions [1][3].