Since yesterday, the Rapid 7 Metasploit team has release an exploit module for Adobe Flash exploit APSA10-01, aka CVE-2010-1297.

The vulnerability affects Adobe Flash 10.0.45.2, 9.0.262, and earlier 10.0.x and 9.0.x versions for Windows, Macintosh, Linux and Solaris, but also Adobe Reader and Acrobat 9.3.2 and earlier 9.x versions for Windows, Macintosh and UNIX. This vulnerability could crash or allow an attacker to take control of the affected system.

So, as I understand, all Internet could own all Internet, a big party in perspective. How is not using Flash ?

The actual attack transmission vector is done between a crafted PDF file embedding a vulnerable Flash animation. So, if you are downloading these kind of PDFs from Internet, or open emails with attached PDF, and open it with Adobe Reader you could be owned.

We have successfully test the exploit with Adobe Reader 9.3.0 on Internet Explorer 8, Safari 5.

No results with Google Chrome 5.0.375.70 and Firefox 3.5.9.

With Foxit Reader the PDF is not lunching the Flash animation, so the exploit is not working.

Adobe has release updates for Flash Player, APSB10-14, so don’t hesitate to update your browsers add-ons.

Here under a video we have done, to demonstrate how it is easy to exploit this vulnerability with Metasploit.

[youtube JW7B8aZsT88]