CVE-2015-8411

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player's MovieClip.startDrag method. When an attacker supplies an object with a custom valueOf function as a parameter, the method can free the MovieClip before the function completes, and subsequent use of the freed memory leads to memory corruption [2]. Affected versions include Flash Player before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204 and corresponding AIR SDK versions [1].

Exploitation

An attacker can trigger the vulnerability by coercing a victim to open a specially crafted SWF file in Adobe Flash Player. The exploit requires no additional privileges and is accomplished by creating a MovieClip, calling startDrag with an object whose valueOf method is defined to remove the MovieClip during execution. This frees the object while it is still referenced, enabling the attacker to control the freed memory and execute arbitrary code [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Flash Player. This can lead to full system compromise, including installation of programs, viewing, changing, or deleting data, and creating new accounts with full user rights. The vulnerability is rated as critical with a CVSS score of 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) [1].

Mitigation

Adobe released security updates in December 2015: Flash Player 20.0.0.228 (Windows/Mac), 11.2.202.559 (Linux), and Adobe AIR 20.0.0.204. Users should upgrade to these fixed versions immediately. Gentoo Linux users can update via emerge to >=www-plugins/adobe-flash-11.2.202.559 [1]. No workaround is available for unpatched versions [1].