The Metasploit Project hosts the world's largest database of quality assured exploits, including hundreds of remote exploits, auxiliary modules, and payloads. You can even review the Metasploit Framework source code of any module - or write your own.

Search for modules

Adobe Flash Player "newfunction" Invalid Pointer Use

This module exploits a vulnerability in the DoABC tag handling within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash movie into a PDF document. An AcroJS heap spray is used in order to ensure that the memory used by the invalid pointer issue is controlled. NOTE: This module uses a similar DEP bypass method to that used within the adobe_libtiff module. This method is unlikely to work across various Windows versions due a the hardcoded syscall number.

Rank

• Normal

Authors

• Unknown < >
• jduck < jduck [at] metasploit.com >

References

• CVE-2010-1297
• OSVDB-65141
• BID-40586
• http://www.adobe.com/support/security/advisories/apsa10-01.html
• http://feliam.wordpress.com/2010/02/11/flash-on-a-pdf-with-minipdf-py/

Exploit Targets

• 0 - Automatic (default)

Development

• Source Code
• History

Similar Modules

• exploit/windows/browser/adobe_cooltype_sing
• exploit/windows/browser/adobe_flashplayer_avm
• exploit/windows/browser/adobe_flashplayer_flash10o
• exploit/windows/browser/adobe_flatedecode_predictor02
• exploit/windows/browser/adobe_geticon
• exploit/windows/browser/adobe_jbig2decode
• exploit/windows/browser/adobe_media_newplayer
• exploit/windows/browser/adobe_shockwave_rcsl_corruption
• exploit/windows/browser/adobe_utilprintf
• exploit/windows/browser/aim_goaway

Usage Information

Module Options