CVE-2010-1297
published 2010-06-08CVE-2010-1297: Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before…
PriorityP188high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-06-22
Exploited in the wild
EPSS
82.36%
99.6th percentile
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | acrobat | >= 8.0 < 8.2.3 | 8.2.3 |
| adobe | acrobat | >= 9.0 < 9.3.3 | 9.3.3 |
| adobe | air | < 2.0.2.12610 | 2.0.2.12610 |
| adobe | flash_player | < 9.0.277.0 | 9.0.277.0 |
| adobe | flash_player | >= 10.0 < 10.1.53.64 | 10.1.53.64 |
| opensuse | opensuse | 11.0 – 11.2 | — |
| suse | linux_enterprise | — | — |
| suse | linux_enterprise | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
%u33dd%u3030 (heap spray pointer to XCHG ESP,EBX in authplay.dll at 0x303033DD)
bytes↗
\x5a\x90\x54\x90\x5a\xeb\x15\x58\x8b\x1a\x89\x18\x83\xc0\x04\x83\xc2\x04\x81\xfb\x0c\x0c\x0c\x0c\x75\xee\xeb\x05\xe8\xe6\xff\xff\xff\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\xff\xff\xff\x90
- →Exploit delivers a crafted PDF with an embedded SWF file; the PDF is served with Content-Type 'application/pdf' and Pragma 'no-cache'. Detect HTTP responses serving PDF files with embedded SWF content (DoABC tag) to browser/Reader clients. ↗
- →The exploit uses an AcroJS heap spray with the repeating pointer pattern %u33dd%u3030 (pointing to XCHG ESP,EBX gadget at 0x303033DD in authplay.dll). Detect this Unicode escape sequence in JavaScript embedded in PDF documents. ↗
- →The vulnerability is triggered via the AVM2 'newfunction' instruction inside a DoABC tag in a SWF file. Inspect SWF files for malformed DoABC tags as an indicator of exploitation attempts. ↗
- →The Metasploit module uses HTTP chunked transfer encoding and gzip compression when delivering the malicious PDF. Inspect gzip-compressed, chunked HTTP responses delivering application/pdf for embedded SWF exploit content. ↗
- →The DEP bypass ROP chain uses gadgets exclusively from BIB.dll (base 0x07000000 range). Presence of ROP gadget addresses in the 0x0700xxxx range on the stack or heap is a strong indicator of this specific exploit. ↗
- →The exploit embeds a SWF into a PDF using the RichMedia annotation subtype /Flash with /Condition /PO (page open) activation. Detect PDFs containing /RichMedia annotations with /Subtype /Flash and /Condition /PO. ↗
- →Live malware samples for this CVE were originally hosted at http://qoop.org/security/poc/cve-2010-1297/. Network connections to this URL should be treated as highly suspicious. ↗
- ·The ROP-based DEP bypass is hardcoded to BIB.dll gadget addresses and is only reliable on specific Windows versions (tested on Windows XP SP3 with Adobe Reader 9.3.0–9.3.2). The exploit will likely fail on other Windows versions. ↗
- ·The Metasploit module (v2/16687) uses file-based delivery (writes msf.pdf to disk) rather than a web server handler, unlike the earlier v1 (16614) which serves the PDF over HTTP. Detection strategies must account for both delivery modes. ↗
- ·The exploit embeds a static SWF file (CVE-2010-1297.swf) from the Metasploit data directory; the SWF itself does not change between requests, making file hash detection of the SWF component viable. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Adobe Flash Player Memory Corruption Vulnerability
cisa·2022-06-08·CVSS 7.8
CVE-2010-1297 [HIGH] CWE-787 Adobe Flash Player Memory Corruption Vulnerability
Vulnerability: Adobe Flash Player Memory Corruption Vulnerability
Affected: Adobe Flash Player
Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2010-1297
Remediation Due Date: 2022-06-22
Red Hat
flash-plugin: Arbitrary code execution by opening a specially-crafted PDF file with malicious SWF content (APSA10-01)
vendor_redhat·2010-06-04·CVSS 7.8
CVE-2010-1297 [HIGH] flash-plugin: Arbitrary code execution by opening a specially-crafted PDF file with malicious SWF content (APSA10-01)
flash-plugin: Arbitrary code execution by opening a specially-crafted PDF file with malicious SWF content (APSA10-01)
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.
GHSA
GHSA-cv7g-qpjc-66p7: Adobe Flash Player before 9
ghsa_unreviewed·2022-05-02
CVE-2010-1297 [HIGH] CWE-787 GHSA-cv7g-qpjc-66p7: Adobe Flash Player before 9
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.
VulnCheck
Adobe Flash Player Memory Corruption Vulnerability
vulncheck·2010·CVSS 7.8
CVE-2010-1297 [HIGH] CWE-787 Adobe Flash Player Memory Corruption Vulnerability
Adobe Flash Player Memory Corruption Vulnerability
Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Affected: Adobe Flash Player
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Exploitation References: https://www.cve.org/CVERecord?id=CVE-2010-1297; https://web.archive.org/web/20120907091804/http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf; https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf; https://cisa.gov/news-events/alerts/2010/06/08/adobe-flash-reader-and-acrobat-vulnerability; https://cisa.gov/news-events/alerts/2010/06/11/adobe-flash-
Suricata
ET WEB_CLIENT Adobe Authplay.dll NewClass Memory Corruption Attempt
suricata·2011-07-15
CVE-2010-1297 ET WEB_CLIENT Adobe Authplay.dll NewClass Memory Corruption Attempt
ET WEB_CLIENT Adobe Authplay.dll NewClass Memory Corruption Attempt
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Adobe Authplay.dll NewClass Memory Corruption Attempt"; flow:established,to_client; flowbits:isset,ET.flash.pdf; file.data; content:"|D2 60 38 40 BA 03 14 0E|"; reference:url,www.exploit-db.com/adobe-acrobat-newclass-invalid-pointer-vulnerability/; reference:bid,40586; reference:cve,2010-1297; classtype:attempted-user; sid:2013281; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_07_15, cve CVE_2010_1297, deployment Perimeter, confidence Medium, signature_severity Major, tag Web_Client_Attacks, updated_at 2024_04_09;)
Suricata
ET WEB_CLIENT Possible Adobe Acrobat Reader Newclass Invalid Pointer Remote Code Execution Attempt
suricata·2010-09-29
CVE-2010-1297 ET WEB_CLIENT Possible Adobe Acrobat Reader Newclass Invalid Pointer Remote Code Execution Attempt
ET WEB_CLIENT Possible Adobe Acrobat Reader Newclass Invalid Pointer Remote Code Execution Attempt
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Adobe Acrobat Reader Newclass Invalid Pointer Remote Code Execution Attempt"; flow:established,to_client; flowbits:isset,ET.flash.pdf; file.data; content:"|F2 3D 8D 23|"; reference:url,www.exploit-db.com/adobe-acrobat-newclass-invalid-pointer-vulnerability/; reference:cve,2010-1297; classtype:attempted-user; sid:2011519; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_29, cve CVE_2010_1297, deployment Perimeter, confidence Medium, signature_severity Major, tag Web_Client_Attacks, updated_at 2024_04_09, mitre_tactic_id TA0001,
Suricata
ET WEB_CLIENT PDF With Embedded Flash Possible Remote Code Execution Attempt
suricata·2010-09-27
CVE-2010-1297 ET WEB_CLIENT PDF With Embedded Flash Possible Remote Code Execution Attempt
ET WEB_CLIENT PDF With Embedded Flash Possible Remote Code Execution Attempt
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF With Embedded Flash Possible Remote Code Execution Attempt"; flow:established,to_client; file.data; content:"PDF-"; depth:300; content:"/SubType"; distance:0; content:"flash"; nocase; within:100; reference:url,feliam.wordpress.com/2010/02/11/flash-on-a-pdf-with-minipdf-py/; reference:cve,2010-1297; classtype:bad-unknown; sid:2011505; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_27, cve CVE_2010_1297, deployment Perimeter, confidence Medium, signature_severity Major, tag Web_Client_Attacks, updated_at 2024_04_09, mitre_tactic_id TA0001, mitre_tactic_n
Suricata
ET WEB_CLIENT PDF With Embedded Adobe Shockwave Flash Possibly Related to Remote Code Execution Attempt
suricata·2010-09-27
CVE-2010-1297 ET WEB_CLIENT PDF With Embedded Adobe Shockwave Flash Possibly Related to Remote Code Execution Attempt
ET WEB_CLIENT PDF With Embedded Adobe Shockwave Flash Possibly Related to Remote Code Execution Attempt
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF With Embedded Adobe Shockwave Flash Possibly Related to Remote Code Execution Attempt"; flow:established,to_client; flowbits:set,ET.flash.pdf; flowbits:noalert; file.data; content:"PDF-"; depth:300; content:".swf"; fast_pattern; nocase; distance:0; reference:url,feliam.wordpress.com/2010/02/11/flash-on-a-pdf-with-minipdf-py/; reference:cve,2010-1297; reference:cve,2010-2201; classtype:bad-unknown; sid:2011499; rev:7; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_27, cve CVE_2010_1297, deployment Perimeter, performance_impact Signif
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id INSERT
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id INSERT
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id INSERT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id INSERT"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:1; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004537; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id DELETE
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id DELETE
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id DELETE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id DELETE"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:1; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004538; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UPDATE
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UPDATE
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UPDATE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UPDATE"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:1; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004540; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access,
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UNION SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UNION SELECT
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UNION SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UNION SELECT"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:1; pcre:"/UNION\s+?SELECT/i"; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004536; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id ASCII
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id ASCII
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id ASCII
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id ASCII"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:1; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004539; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id SELECT
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id SELECT"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:1; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004535; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
YARA
FlashNewfunction
yara·CVSS 7.8
CVE-2010-1297 [HIGH] FlashNewfunction
rule FlashNewfunction: decodedPDF
{
meta:
ref = "CVE-2010-1297"
hide = true
impact = 5
ref = "http://blog.xanda.org/tag/jsunpack/"
strings:
$unescape = "unescape" fullword nocase
$shellcode = /%u[A-Fa-f0-9]{4}/
$shellcode5 = /(%u[A-Fa-f0-9]{4}){5}/
$cve20101297 = /\/Subtype ?\/Flash/
condition:
($unescape and $shellcode and $cve20101297) or ($shellcode5 and $cve20101297)
}
Exploit-DB
Adobe Flash Player - 'newfunction' Invalid Pointer Use (Metasploit) (2)
exploitdb·2010-09-25
CVE-2010-1297 Adobe Flash Player - 'newfunction' Invalid Pointer Use (Metasploit) (2)
Adobe Flash Player - 'newfunction' Invalid Pointer Use (Metasploit) (2)
---
##
# $Id: adobe_flashplayer_newfunction.rb 10477 2010-09-25 11:59:02Z mc $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
require 'zlib'
class Metasploit3 'Adobe Flash Player "newfunction" Invalid Pointer Use',
'Description' => %q{
This module exploits a vulnerability in the DoABC tag handling within
versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also
vulnerable, as are any other applications that may embed Flash player.
Arbitrary code execution is achieve
Exploit-DB
Adobe Flash Player - 'newfunction' Invalid Pointer Use (Metasploit) (1)
exploitdb·2010-09-20
CVE-2010-1297 Adobe Flash Player - 'newfunction' Invalid Pointer Use (Metasploit) (1)
Adobe Flash Player - 'newfunction' Invalid Pointer Use (Metasploit) (1)
---
##
# $Id: adobe_flashplayer_newfunction.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
require 'zlib'
class Metasploit3 'Adobe Flash Player "newfunction" Invalid Pointer Use',
'Description' => %q{
This module exploits a vulnerability in the DoABC tag handling within
versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also
vulnerable, as are any other applications that may embed Flash player.
Arbitrary code execution is achi
Exploit-DB
Adobe Acrobat Reader and Flash Player - 'newclass' Invalid Pointer
exploitdb·2010-09-01·CVSS 7.8
CVE-2010-1297 [HIGH] Adobe Acrobat Reader and Flash Player - 'newclass' Invalid Pointer
Adobe Acrobat Reader and Flash Player - 'newclass' Invalid Pointer
---
'''
__ __ ____ _ _ ____
| \/ |/ __ \ /\ | | | | _ \
| \ / | | | | / \ | | | | |_) |
| |\/| | | | |/ /\ \| | | | _ >' + self.eol
else:
self.content += self.eol + data + self.eol
self.content += 'endobj' + self.eol
def obj_SWFStream(self, obj_num, data, stream):
self.xrefs.append(len(self.content))
self.content += '%d 0 obj' % obj_num
self.content += self.eol + '> /DL %d /Length %d' %(len(stream),len(stream),len(stream))
self.content += ' >>' + self.eol
self.content += 'stream' + self.eol + stream + self.eol + 'endstream' + self.eol
self.content += 'endobj' + self.eol
def obj_Stream(self, obj_num, data, stream):
self.xrefs.append(len(self.content))
self.content += '%d 0 obj' % obj_num
self.content += self.eol + '>' +
Exploit-DB
Adobe Flash / Reader - Live Malware
exploitdb·2010-06-09
CVE-2010-1297 Adobe Flash / Reader - Live Malware
Adobe Flash / Reader - Live Malware
---
# Exploit-DB Note - Live POC originally found at http://qoop.org/security/poc/cve-2010-1297/
# File is malicious! Taken from the wild! Beware!
# To decrypt the file:
# openssl aes-256-cbc -d -a -in adobe-0day-2010-1297.tar.enc -out adobe-0day-2010-1297.tar
# Password is "edb" without the quotes.
NOTE: This was taken out of live malware and was not modified. BEWARE.
By visiting the following link, you agree that you are responsible for any damages that occur.
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13787.tar.enc (adobe-0day-2010-1297.tar.enc)
Metasploit
Adobe Flash Player "newfunction" Invalid Pointer Use
metasploit
Adobe Flash Player "newfunction" Invalid Pointer Use
Adobe Flash Player "newfunction" Invalid Pointer Use
This module exploits a vulnerability in the DoABC tag handling within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash movie into a PDF document. An AcroJS heap spray is used in order to ensure that the memory used by the invalid pointer issue is controlled. NOTE: This module uses a similar DEP bypass method to that used within the adobe_libtiff module. This method is unlikely to work across various Windows versions due a hardcoded syscall number.
Metasploit
Adobe Flash Player "newfunction" Invalid Pointer Use
metasploit
Adobe Flash Player "newfunction" Invalid Pointer Use
Adobe Flash Player "newfunction" Invalid Pointer Use
This module exploits a vulnerability in the DoABC tag handling within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash movie into a PDF document. An AcroJS heap spray is used in order to ensure that the memory used by the invalid pointer issue is controlled. NOTE: This module uses a similar DEP bypass method to that used within the adobe_libtiff module. This method is unlikely to work across various Windows versions due a the hardcoded syscall number.
Bugzilla
acroread: multiple code execution flaws (APSB10-15)
bugzilla·2010-06-29·CVSS 9.3
[CRITICAL] acroread: multiple code execution flaws (APSB10-15)
acroread: multiple code execution flaws (APSB10-15)
Today, 2010-06-29, Adobe is planning to release an update
for Adobe Reader of version v9.3.2 and Adobe Acrobat of
version 9.3.2 (new version for both products is v9.3.3),
to address multiple security issues allowing code execution,
whose description is detailed in the Adobe Security Bulletin
APSB10-15:
[1] http://www.adobe.com/support/security/bulletins/apsb10-15.html
* This update resolves a memory corruption vulnerability that could
lead to code execution (CVE-2010-1297). Note: There are reports that
this issue is being actively exploited in the wild.
Red Hat is tracking this memory corruption vulnerability via a
dedicated Red Hat Bugzilla entry, which is reachable at:
[2] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-1297
Bugzilla
flash-plugin: multiple security flaws (APSB10-14)
bugzilla·2010-06-10·CVSS 9.3
CVE-2010-1297 [CRITICAL] flash-plugin: multiple security flaws (APSB10-14)
flash-plugin: multiple security flaws (APSB10-14)
Today, 2010-06-10, Adobe is planning to release an update
for Adobe Flash Player of version 10.0.45.2 (new version
is 10.1.53.64), to address multiple security issues allowing
code execution, whose description is detailed in the Adobe
Security Bulletin APSB10-14:
[1] http://www.adobe.com/support/security/bulletins/apsb10-14.html
* This update resolves a memory corruption vulnerability that could lead
to code execution (CVE-2010-1297). Note: There are reports that this
issue is being actively exploited in the wild.
* This update resolves a memory exhaustion vulnerability that could lead
to code execution (CVE-2009-3793).
* This update resolves a memory corruption vulnerability that could lead
to code execution (CVE-2010-2160).
* This u
Bugzilla
CVE-2010-1297 acroread, flash-plugin: Arbitrary code execution by opening a specially-crafted PDF file with malicious SWF content (APSA10-01)
bugzilla·2010-06-05·CVSS 7.8
CVE-2010-1297 [HIGH] CVE-2010-1297 acroread, flash-plugin: Arbitrary code execution by opening a specially-crafted PDF file with malicious SWF content (APSA10-01)
CVE-2010-1297 acroread, flash-plugin: Arbitrary code execution by opening a specially-crafted PDF file with malicious SWF content (APSA10-01)
Adobe published an advisory:
[1] http://www.adobe.com/support/security/advisories/apsa10-01.html
detailing information about one critical vulnerability (from [1]):
A critical vulnerability exists in Adobe Flash Player 10.0.45.2 and earlier
versions for Windows, Macintosh, Linux and Solaris operating systems, and
the authplay.dll component that ships with Adobe Reader and Acrobat 9.x
for Windows, Macintosh and UNIX operating systems. This vulnerability
(CVE-2010-1297) could cause a crash and potentially allow an attacker to
take control of the affected system. There are reports that this
vulnerability is being actively exploited in the wild against
arXiv
Digital Investigation of PDF Files: Unveiling Traces of Embedded Malware
arxiv_fulltext·2017-07-17
Digital Investigation of PDF Files: Unveiling Traces of Embedded Malware
Digital Investigation of PDF Files:\ Traces of Embedded Malware
Davide Maiorca, Member, IEEE,
Battista Biggio, Senior Member, IEEE,
Preprint of the work accepted for publication in the IEEE Security & Privacy magazine, Special Issue on Digital Forensics, Nov. - Dec. 2017, http://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=7854112
The authors are with the Department of Electrical and Electronic Engineering, University of Cagliari, Piazza d'Armi, 09123 Cagliari, Italy.
Davide Maiorca: e-mail [email protected]
Battista Biggio: e-mail [email protected]
## Abstract
Over the last decade, malicious software (or malware, for short) has shown an increasing sophistication and proliferation, fueled by a flourishing underground economy, in response to the increasing complex
Securelist
Investigation Report for the September 2014 Equation malware detection incident in the US
blogs_securelist·2017-11-16
Investigation Report for the September 2014 Equation malware detection incident in the US
Authors
- Kaspersky
## Background
In early October, a story was published by the Wall Street Journal alleging Kaspersky Lab software was used to siphon classified data from an NSA employee’s home computer system. Given that Kaspersky Lab has been at the forefront of fighting cyberespionage and cybercriminal activities on the Internet for over 20 years now, these allegations were treated very seriously. To assist any independent investigators and all the people who have been asking us questions whether those allegations were true, we decided to conduct an internal investigation to attempt to answer a few questions we had related to the article and some others that followed it:
1. Was our software used outside of its intended functionality to pull classified information from a person’s c
Securelist
Investigation Report for the September 2014 Equation malware detection incident in the US
blogs_securelist·2017-11-16
Investigation Report for the September 2014 Equation malware detection incident in the US
Authors
Kaspersky
## Background
In early October, a story was published by the Wall Street Journal alleging Kaspersky Lab software was used to siphon classified data from an NSA employee’s home computer system. Given that Kaspersky Lab has been at the forefront of fighting cyberespionage and cybercriminal activities on the Internet for over 20 years now, these allegations were treated very seriously. To assist any independent investigators and all the people who have been asking us questions whether those allegations were true, we decided to conduct an internal investigation to attempt to answer a few questions we had related to the article and some others that followed it:
Was our software used outside of its intended functionality to pull classified information from a person’s comput
http://blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash/http://community.websense.com/blogs/securitylabs/archive/2010/06/09/having-fun-with-adobe-0-day-exploits.aspxhttp://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-06/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.htmlhttp://secunia.com/advisories/40026http://secunia.com/advisories/40034http://secunia.com/advisories/40144http://secunia.com/advisories/40545http://secunia.com/advisories/43026http://security.gentoo.org/glsa/glsa-201101-09.xmlhttp://securitytracker.com/id?1024057http://securitytracker.com/id?1024058http://securitytracker.com/id?1024085http://securitytracker.com/id?1024086http://support.apple.com/kb/HT4435http://www.adobe.com/support/security/advisories/apsa10-01.htmlhttp://www.adobe.com/support/security/bulletins/apsb10-14.htmlhttp://www.adobe.com/support/security/bulletins/apsb10-15.htmlhttp://www.exploit-db.com/exploits/13787http://www.kb.cert.org/vuls/id/486225http://www.osvdb.org/65141http://www.redhat.com/support/errata/RHSA-2010-0464.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0470.htmlhttp://www.securityfocus.com/bid/40586http://www.securityfocus.com/bid/40759http://www.turbolinux.co.jp/security/2010/TLSA-2010-19j.txthttp://www.us-cert.gov/cas/techalerts/TA10-159A.htmlhttp://www.us-cert.gov/cas/techalerts/TA10-162A.htmlhttp://www.vupen.com/english/advisories/2010/1348http://www.vupen.com/english/advisories/2010/1349http://www.vupen.com/english/advisories/2010/1421http://www.vupen.com/english/advisories/2010/1432http://www.vupen.com/english/advisories/2010/1434http://www.vupen.com/english/advisories/2010/1453http://www.vupen.com/english/advisories/2010/1482http://www.vupen.com/english/advisories/2010/1522http://www.vupen.com/english/advisories/2010/1636http://www.vupen.com/english/advisories/2010/1793http://www.vupen.com/english/advisories/2011/0192https://exchange.xforce.ibmcloud.com/vulnerabilities/59137https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7116http://blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash/http://community.websense.com/blogs/securitylabs/archive/2010/06/09/having-fun-with-adobe-0-day-exploits.aspxhttp://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-06/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.htmlhttp://secunia.com/advisories/40026http://secunia.com/advisories/40034http://secunia.com/advisories/40144http://secunia.com/advisories/40545http://secunia.com/advisories/43026http://security.gentoo.org/glsa/glsa-201101-09.xmlhttp://securitytracker.com/id?1024057http://securitytracker.com/id?1024058http://securitytracker.com/id?1024085http://securitytracker.com/id?1024086http://support.apple.com/kb/HT4435http://www.adobe.com/support/security/advisories/apsa10-01.htmlhttp://www.adobe.com/support/security/bulletins/apsb10-14.htmlhttp://www.adobe.com/support/security/bulletins/apsb10-15.htmlhttp://www.exploit-db.com/exploits/13787http://www.kb.cert.org/vuls/id/486225http://www.osvdb.org/65141http://www.redhat.com/support/errata/RHSA-2010-0464.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0470.htmlhttp://www.securityfocus.com/bid/40586http://www.securityfocus.com/bid/40759http://www.turbolinux.co.jp/security/2010/TLSA-2010-19j.txthttp://www.us-cert.gov/cas/techalerts/TA10-159A.htmlhttp://www.us-cert.gov/cas/techalerts/TA10-162A.htmlhttp://www.vupen.com/english/advisories/2010/1348http://www.vupen.com/english/advisories/2010/1349http://www.vupen.com/english/advisories/2010/1421http://www.vupen.com/english/advisories/2010/1432http://www.vupen.com/english/advisories/2010/1434http://www.vupen.com/english/advisories/2010/1453http://www.vupen.com/english/advisories/2010/1482http://www.vupen.com/english/advisories/2010/1522http://www.vupen.com/english/advisories/2010/1636http://www.vupen.com/english/advisories/2010/1793http://www.vupen.com/english/advisories/2011/0192https://exchange.xforce.ibmcloud.com/vulnerabilities/59137https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7116https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1297
2010-06-08
Published
2022-06-08
Added to CISA KEV
Exploited in the wild