CVE-2015-8424

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player's TextField.replaceText function. When the function is called with a string parameter that has a custom toString method, or an integer parameter with a custom valueOf method, the parent object of the TextField can be freed and then accessed, leading to a use-after-free condition [1]. All three parameters of replaceText are susceptible. Affected versions include Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X, before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 [2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious SWF file that triggers the use-after-free. The provided proof-of-concept demonstrates calling tf.replaceText(1, 2, {valueOf : func}) where func removes the parent movie clip (mc.removeMovieClip()) and then returns a string [1]. This causes the TextField's parent to be freed while still in use. The attacker must convince a user to open the malicious SWF file, typically via a web page or email attachment. No authentication or special network position is required beyond delivering the file to the victim.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the Adobe Flash Player plugin process [2]. This can lead to full compromise of the affected system, including data theft, installation of malware, or further lateral movement. The vulnerability is rated as critical with a CVSS score of 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) based on the official description.

Mitigation

Adobe released fixed versions on December 8, 2015: Flash Player 18.0.0.268 and 20.0.0.228 for Windows and OS X, 11.2.202.554 for Linux, and AIR 20.0.0.204 [2]. Users should upgrade immediately. The Gentoo security advisory (GLSA 201601-03) recommends upgrading to >=www-plugins/adobe-flash-11.2.202.559 [2]. No workaround is available; the only mitigation is to apply the patch or disable Flash Player if upgrading is not possible.