module

Adobe Flash Player MP4 SequenceParameterSetNALUnit Buffer Overflow

Try Surface Command
Back to search
Disclosed
2011-08-09
Created
2018-05-30

Description

This module exploits a vulnerability found in Adobe Flash Player's Flash10u.ocx
component. When processing a MP4 file (specifically the Sequence Parameter Set),
Flash will see if pic_order_cnt_type is equal to 1, which sets the
num_ref_frames_in_pic_order_cnt_cycle field, and then blindly copies data in
offset_for_ref_frame on the stack, which allows arbitrary remote code execution
under the context of the user. Numerous reports also indicate that this
vulnerability has been exploited in the wild.

Authors

Alexander Gavrun
Unknown
sinn3r sinn3r@metasploit.com

Platform

Windows

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/windows/browser/adobe_flash_sps
    msf exploit(adobe_flash_sps) > show targets
        ...targets...
    msf exploit(adobe_flash_sps) > set TARGET < target-id >
    msf exploit(adobe_flash_sps) > show options
        ...show and set options...
    msf exploit(adobe_flash_sps) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today