CVE-2016-4232

Vulnerability

An information disclosure vulnerability exists in Adobe Flash Player in the Transform.colorTransform getter. By overwriting the ColorTransform constructor with a getter using addProperty, a specially crafted SWF file can trigger a use-after-free condition that reads uninitialized or freed memory. Affected versions include Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X, and before 11.2.202.632 on Linux [1][2][3].

Exploitation

An attacker can exploit this vulnerability by luring a victim to load a malicious SWF file that manipulates the ColorTransform constructor via ActionScript. The PoC demonstrates creating an empty MovieClip, applying a ColorTransform, then adding a property getter for ColorTransform that removes the MovieClip. When reading the colorTransform property, the freed object's memory is accessed and printed to the screen [3]. No authentication or special network position is required beyond delivering the SWF to the victim.

Impact

Successful exploitation results in an information disclosure, leaking arbitrary process memory to the attacker. The leaked data may contain sensitive information such as credentials, cookies, or other secrets present in the Flash Player process memory. The vulnerability does not directly allow code execution but can be a stepping stone for further attacks [3].

Mitigation

Adobe released Flash Player version 22.0.0.209 (Windows/OS X) and 11.2.202.632 (Linux) to address this vulnerability [1][2]. Microsoft included the fix in Security Bulletin MS16-093 for Internet Explorer and Edge on supported Windows platforms [1]. Red Hat and Gentoo also released updated packages [2][4]. Users should update Flash Player to the latest version or disable Flash if it is not required.