search

ohio813 / google-security-research

Automatically exported from code.google.com/p/google-security-research
0 stars 0 forks source link

Type Confusion in NetConnection ASnative #229

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
When a NetConnection AS2 native function is called, the this object is verified 
to either have a type of NetConnection, or to be an untyped object that has a 
__proto__ descendant with type NetConnection. The this object's user data is 
then cast to type NetConnection. The userdata is not verified to be NULL if the 
object is not of type NetConnection. This means that type confusion can occur 
if the __proto__ of an untyped object with a non-null userdata (such as a 
native function object) is set to and object of type NetConnection.

var b = ASnative(2100, 0x77777777);
var n = new NetConnection()
b.__proto__ = n;
var f = ASnative(2100, 0); //NetConnection.connect
f.call(b, 1);

A sample swf and .fla file are attached. To trigger the issue, press the purple 
button.

Original issue reported on code.google.com by natashe...@google.com on 15 Jan 2015 at 8:01

Attachments:

GoogleCodeExporter commented 9 years ago

Original comment by cev...@google.com on 18 Jan 2015 at 10:50

GoogleCodeExporter commented 9 years ago

Original comment by cev...@google.com on 19 Jan 2015 at 8:09

GoogleCodeExporter commented 9 years ago

Original comment by cev...@google.com on 6 Mar 2015 at 6:05

GoogleCodeExporter commented 9 years ago 
https://helpx.adobe.com/security/products/flash-player/apsb15-05.html

Original comment by cev...@google.com on 12 Mar 2015 at 7:35

GoogleCodeExporter commented 9 years ago

Original comment by cev...@google.com on 19 Mar 2015 at 7:57

GoogleCodeExporter commented 9 years ago 
Adding exploit code

Original comment by natashe...@google.com on 13 Apr 2015 at 6:22

Attachments: