Cyber Risks · Unit 42 Palo Alto Networks

The Latest Flash UAF Vulnerabilities in Exploit Kits

Summary: Unit 42 reports that exploit kits Angler, Flash EK, SweetOrange, Fiesta and Neutrino have added use-after-free vulnerabilities in Adobe Flash - CVE-2015-0311, CVE-2015-0313 and CVE-2015-0359 - to their exploits, a shift from the out-of-bounds access bugs they previously favored. All three CVEs sit in the ApplicationDomain class, where a ByteArray freed by ByteArray::compress, ByteArray::decompress or a worker thread is not reported to the ApplicationDomain, which keeps a pointer to the freed buffer.
What you should know: Angler's exploit layer was left unobfuscated with readable names like "attacking_buffer," and its chain ends by faking a GC_object to seize the instruction pointer - a working path from a browser visit to code execution that the kit operators did not bother to hide.

Read the original at Unit 42 Palo Alto Networks ↗

Topics: Malware
Mentions: CVE-2015-0311 CVE-2015-0313 CVE-2015-0359
Related: Understanding Flash Exploitation and the Alleged CVE-2015-0359 Exploit Cyber Risks ·
Angler Exploit Kit - New Variants Cyber Risks ·
CVE-2015-0311: Adobe Flash Player Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Apr 13, 2022