cbcvebase.
CVE-2010-1297
published 2010-06-08

CVE-2010-1297: Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before…

PriorityP188high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-06-22
Exploited in the wild
EPSS
82.36%
99.6th percentile
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

Affected

8 ranges
VendorProductVersion rangeFixed in
adobeacrobat>= 8.0 < 8.2.38.2.3
adobeacrobat>= 9.0 < 9.3.39.3.3
adobeair< 2.0.2.126102.0.2.12610
adobeflash_player< 9.0.277.09.0.277.0
adobeflash_player>= 10.0 < 10.1.53.6410.1.53.64
opensuseopensuse11.0 – 11.2
suselinux_enterprise
suselinux_enterprise

Detection & IOCsextracted from sources · hover to see the quote

filenameCVE-2010-1297.swf
filenameauthplay.dll
urlhttps://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13787.tar.enc
filenameadobe-0day-2010-1297.tar.enc
bytes
%u33dd%u3030 (heap spray pointer to XCHG ESP,EBX in authplay.dll at 0x303033DD)
bytes
\x5a\x90\x54\x90\x5a\xeb\x15\x58\x8b\x1a\x89\x18\x83\xc0\x04\x83\xc2\x04\x81\xfb\x0c\x0c\x0c\x0c\x75\xee\xeb\x05\xe8\xe6\xff\xff\xff\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\xff\xff\xff\x90
  • Exploit delivers a crafted PDF with an embedded SWF file; the PDF is served with Content-Type 'application/pdf' and Pragma 'no-cache'. Detect HTTP responses serving PDF files with embedded SWF content (DoABC tag) to browser/Reader clients.
  • The exploit uses an AcroJS heap spray with the repeating pointer pattern %u33dd%u3030 (pointing to XCHG ESP,EBX gadget at 0x303033DD in authplay.dll). Detect this Unicode escape sequence in JavaScript embedded in PDF documents.
  • The vulnerability is triggered via the AVM2 'newfunction' instruction inside a DoABC tag in a SWF file. Inspect SWF files for malformed DoABC tags as an indicator of exploitation attempts.
  • The Metasploit module uses HTTP chunked transfer encoding and gzip compression when delivering the malicious PDF. Inspect gzip-compressed, chunked HTTP responses delivering application/pdf for embedded SWF exploit content.
  • The DEP bypass ROP chain uses gadgets exclusively from BIB.dll (base 0x07000000 range). Presence of ROP gadget addresses in the 0x0700xxxx range on the stack or heap is a strong indicator of this specific exploit.
  • The exploit embeds a SWF into a PDF using the RichMedia annotation subtype /Flash with /Condition /PO (page open) activation. Detect PDFs containing /RichMedia annotations with /Subtype /Flash and /Condition /PO.
  • Live malware samples for this CVE were originally hosted at http://qoop.org/security/poc/cve-2010-1297/. Network connections to this URL should be treated as highly suspicious.
  • ·The ROP-based DEP bypass is hardcoded to BIB.dll gadget addresses and is only reliable on specific Windows versions (tested on Windows XP SP3 with Adobe Reader 9.3.0–9.3.2). The exploit will likely fail on other Windows versions.
  • ·The Metasploit module (v2/16687) uses file-based delivery (writes msf.pdf to disk) rather than a web server handler, unlike the earlier v1 (16614) which serves the PDF over HTTP. Detection strategies must account for both delivery modes.
  • ·The exploit embeds a static SWF file (CVE-2010-1297.swf) from the Metasploit data directory; the SWF itself does not change between requests, making file hash detection of the SWF component viable.

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.