marc maiffret marceeyecom macromedia shockwave flash malformed header overflow release date august 8 2002 severity high remote code execution systems affected macromedia shockwave flash versions unix windows netscape internet explorer description working prerelease eeye retina cham tools exploitable condition discovered within shockwave flash file format called swf pronounced swif since browser based bug makes trivial bypass firewalls attack user desktop also application browser bugs allow target users based websites visit newsgroups read mailing lists frequent one button push attack using anonymous remailers proxies attacks possible vulnerability proven work versions macromedia flash windows unix ie netscape may run wherever shockwave files may displayed attached including websites email news postings forums instant messengers within applications utilizing webbrowsing functionality technical description data header roughly made flash signatureversion 1file lengtha number bytes shortframe size malformedframe rate malformedframe count malformeddata creating malformed header supply frame data decoder expecting supplying enough data overwrite function pointer address redirect flow control specified location soon address used moment overwritten address takes control flow address pointing portion data 8 bytes back stack pointer using relative jump redirect flow call dword ptr espn n number bytes stack pointer jump points located multiple loaded dlls creating simple tool using debugging api readmemory examine processs virtual address space useful data help exploitation say potentially vulnerable situations found macromedias flash discovered seventeen others ended testing working macromedia issues protection retinar network security scanner already scans latest version flash users systems ensure users within control upgrade systems vendor status macromedia released patch vulnerability available httpwwwmacromediacomv1handlersindexcfmid23293methodfulltitlem psb022d09202d20macromedia20flash20malformed20header20vulnerability2 0issuecachefalse discovery drew copley exploitation riley hassell greetings hacktivismo centra spike copyright c 19982002 eeye digital security permission hereby granted redistribution alert electronically edited way without express consent eeye wish reprint whole part alert medium excluding electronic medium please email alerteeyecom permission disclaimer information within paper may change without notice use information constitutes acceptance use condition warranties regard information event shall author liable damages whatsoever arising connection use spread information use information users risk feedback please send suggestions updates comments eeye digital security httpwwweeyecom infoeeyecom thu 8 aug 2002 172622 0700 vulnwatch eeye macromedia shockwave flash malformed header overflow