News
Vigil@nce: Adobe Flash, file reading
March 2010 by Vigil@nce
SYNTHESIS OF THE VULNERABILITY
An attacker can create a malicious Flash application, which indicates file fragments to a CIFS/SMB share.
Severity: 2/4
Consequences: data reading
Provenance: document
Means of attack: 1 proof of concept
Ability of attacker: specialist (3/4)
Confidence: unique source (2/5)
Diffusion of the vulnerable configuration: high (3/3)
Creation date: 04/03/2010
IMPACTED PRODUCTS
Adobe Flash Player
DESCRIPTION OF THE VULNERABILITY
A Flash application can be conceived with two modes
"Access local files only" : no network access, excepted a CIFS
server on the same local network
"Access network only" : no local access
An application is thus not allowed to transfer data from user’s
computer to the internet.
In "local files only" mode, the application can use the URLLoader class to read a local file, or a file located on a CIFS/SMB share.
An application can therefore use URLLoader to read a file located on victim’s computer. This file for example contains "hello". The application can then try to read "\\1.2.3.4\public\hello", where "1.2.3.4" is a CIFS server owned by the attacker. The "hello" file does not exist on the CIFS share, so this generates an error which is logged.
The attacker can then read logs of his CIFS server, in order to obtain data fragments ("hello") coming from victim’s computer.
An attacker can therefore create a malicious Flash application, which indicates file fragments to a CIFS/SMB share.
CHARACTERISTICS
Identifiers: BID-38517, VIGILANCE-VUL-9495
