CVE-2011-2110

Related Files

Adobe Flash Player AVM Verification Logic Array Indexing Code Execution

Posted Jun 20, 2012

Authored by mr_me | Site metasploit.com

This Metasploit module exploits a vulnerability in Adobe Flash Player versions 10.3.181.23 and earlier. This issue is caused by a failure in the ActionScript3 AVM2 verification logic. This results in unsafe JIT(Just-In-Time) code being executed. This is the same vulnerability that was used for attacks against Korean based organizations. Specifically, this issue occurs when indexing an array using an arbitrary value, memory can be referenced and later executed. Taking advantage of this issue does not rely on heap spraying as the vulnerability can also be used for information leakage. Currently this exploit works for IE6, IE7, IE8, Firefox 10.2 and likely several other browsers under multiple Windows platforms. This exploit bypasses ASLR/DEP and is very reliable.

tags | exploit, arbitrary

systems | windows

advisories | CVE-2011-2110, OSVDB-48268

SHA-256 | e26bbead67100b455a3fddb8cfcf7df0baddef6b4fbc68f4cc261a2c4dea9972

Download | Favorite | View

Red Hat Security Advisory 2011-0869-01

Posted Jun 15, 2011

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2011-0869-01 - The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes one vulnerability in Adobe Flash Player. This vulnerability is detailed on the Adobe security page APSB11-18, listed in the References section. Specially-crafted SWF content could cause flash-plugin to crash or, potentially, execute arbitrary code. All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 10.3.181.26. Various other issues were also addressed.

tags | advisory, web, arbitrary

systems | linux, redhat

advisories | CVE-2011-2110

SHA-256 | 681b65e302d8af8fcc72423d214ba93b558f71e8a6dab3d4ed847ce30c5fe9e6

Download | Favorite | View