CVE-2016-4271

Vulnerability

Adobe Flash Player before version 18.0.0.375 and versions 19.0 through 23.0 before 23.0.0.162 on Windows and OS X, and before version 11.2.202.635 on Linux, contains a local-with-filesystem sandbox bypass. The vulnerability stems from a design flaw that allows a locally opened SWF file (using file:// or UNC paths without an IP address or qualifying domain) to combine two URI schemes to initiate outbound SMB connections, effectively bypassing the sandbox restrictions that should prevent Internet access [1], [2].

Exploitation

An attacker must first convince a user to open a crafted local SWF file (e.g., via a downloaded attachment or a file hosted on a share). The SWF file runs within the local-with-filesystem sandbox. By leveraging the unspecified combination of URI schemes, the attacker can make the Flash Player initiate an SMB connection to a remote attacker-controlled server. No other special network position or authentication is required beyond the user opening the file [2].

Impact

Successful exploitation allows an attacker to exfiltrate local data from the victim's machine and obtain Windows user credentials (e.g., NTLM hashes) through the SMB connection. This constitutes a bypass of the security sandbox, leading to sensitive information disclosure [2]. The vulnerability was a key factor in Adobe's decision to discontinue the local-with-filesystem sandbox from Flash Player 23.0.0.162 onward [2].

Mitigation

Adobe fixed this vulnerability in Flash Player 23.0.0.162 (and 11.2.202.635 on Linux) released on September 13, 2016, as documented in APSB16-29 [2]. Red Hat and Gentoo security advisories recommend upgrading to the patched versions [1], [3]. For systems that cannot upgrade, the only known workaround is to disable Flash Player or to avoid opening local SWF files from untrusted sources. No KEV listing is currently available.