Zero-day vulnerability in Adobe Flash Player
Arbitrary code execution
CVE-2013-0643
Vulnerability details
Advisory: SB2013022601 - Multiple vulnerabilities in Adobe Flash Player
Vulnerable component: Adobe Flash Player
CVE-ID: CVE-2013-0643
CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
Description:
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to an error when handling permissions of the Flash Player Firefox sandbox. A remote attacker can create specially crafted Web site serving malicious Flash (SWF) content, trick the victim into visiting it, bypass the sandbox restrictions and execute arbitrary code outside the sandbox with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
External links:
http://www.adobe.com/support/security/bulletins/apsb13-08.html
http://doa.alaska.gov/ets/security/S_Advisory/sa2013-023.pdf
https://krebsonsecurity.com/2013/02/flash-player-update-fixes-zero-day-flaws/#more-19186
http://www.techworld.com/news/security/adobe-pushes-out-emergency-flash-update-as-hackers-hit-firefo...
https://www.scmagazine.com/adobe-hurries-update-to-fix-flash-zero-day-vulnerabilities/article/542241...
http://www.computerworld.com/article/2495576/malware-vulnerabilities/adobe-springs-emergency-flash-u...
http://www.theregister.co.uk/2013/02/27/adobe_issues_two_critical_flash_vuln_patches/
https://blog.qualys.com/laws-of-vulnerabilities/2013/02