SID 1:47532

Rule Category

FILE-FLASH -- Snort has detected suspicious traffic via the Adobe Flash Player. Flash is a common target of code execution, overflow, DoS, and memory corruption attacks in particular, via swifs, action scripts, etc. Many networks block Flash altogether; the application will be deprecated in 2020.

Alert Message

FILE-FLASH Adobe Flash Player Vector.String class out-of-bounds read attempt

Rule Explanation

This event is generated when a maliciously crafted Flash movie is detected traversing the network. Impact: Attempted User Privilege Gain Details: The vulnerability is caused by the computation that reads data past the end of the intended buffer; the computation is part of the ActionScript 3 VM that handles native code constructor calls. Crafted SWF input triggers the flawed computation where pointer arithmetic is not appropriately checked against boundary conditions, which leads to memory write operation through the pointer that points to an invalid memory location. The vulnerability is a result of out of range pointer offset that is used to access sub-elements of an internal data structure. An attacker can potentially leverage the vulnerability to leak sensitive data (e.g., memory addresses). Ease of Attack:

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group