Published: 16/06/2011 Updated: 30/10/2018

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Adobe Flash Player prior to 10.3.181.26 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.23 and previous versions on Android, allows remote malicious users to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in June 2011.

Vulnerable Product	Search on Vulmon	Subscribe to Product
adobe flash_player 10.1.52.14.1
adobe flash_player 10.1.102.64
adobe flash_player 10.0.42.34
adobe flash_player 10.0.45.2
adobe flash_player 9.0.28
adobe flash_player 9.0.260.0
adobe flash_player 10.1.92.10
adobe flash_player 10.0.15.3
adobe flash_player 9.0.112.0
adobe flash_player 9.0.246.0
adobe flash_player 9.0.45.0
adobe flash_player 9.0.114.0
adobe flash_player 9.0.31.0
adobe flash_player 9.0.124.0
adobe flash_player 8.0.22.0
adobe flash_player 8.0.42.0
adobe flash_player 7.0.66.0
adobe flash_player 7.0.73.0
adobe flash_player 7.0.67.0
adobe flash_player 7.1.1
adobe flash_player 7.0.14.0
adobe flash_player 6.0.79
adobe flash_player 10.1.85.3
adobe flash_player 10.2.152.33
adobe flash_player 10.2.154.13
adobe flash_player 10.1.95.1
adobe flash_player 10.0.12.10
adobe flash_player 10.0.0.584
adobe flash_player 9.0.18d60
adobe flash_player 9.0.16
adobe flash_player 9.0.125.0
adobe flash_player 9.0.28.0
adobe flash_player 10.0.22.87
adobe flash_player 9.0
adobe flash_player 9.0.155.0
adobe flash_player 7.0.25
adobe flash_player 7.0.63
adobe flash_player 9.0.20
adobe flash_player 7.0.24.0
adobe flash_player 7.0.1
adobe flash_player 7.2
adobe flash_player 7.0.70.0
adobe flash_player 9.0.277.0
adobe flash_player 10.1.82.76
adobe flash_player 10.1.92.8
adobe flash_player 10.3.181.14
adobe flash_player 10.3.181.16
adobe flash_player 9.0.20.0
adobe flash_player 9.0.283.0
adobe flash_player 8.0
adobe flash_player 8.0.24.0
adobe flash_player 9.0.48.0
adobe flash_player 9.0.115.0
adobe flash_player 7.0.53.0
adobe flash_player 7.0.60.0
adobe flash_player 7.0.19.0
adobe flash_player 7.0.69.0
adobe flash_player 10.1.53.64
adobe flash_player 10.1.52.15
adobe flash_player 10.2.152
adobe flash_player 10.2.152.32
adobe flash_player
adobe flash_player 10.0.12.36
adobe flash_player 10.0.32.18
adobe flash_player 9.0.152.0
adobe flash_player 9.0.151.0
adobe flash_player 9.125.0
adobe flash_player 9.0.262.0
adobe flash_player 9.0.159.0
adobe flash_player 9.0.31
adobe flash_player 8.0.33.0
adobe flash_player 8.0.39.0
adobe flash_player 8.0.35.0
adobe flash_player 7.1
adobe flash_player 7.0.68.0
adobe flash_player 7.0.61.0
adobe flash_player 7.0
adobe flash_player 6.0.21.0
adobe flash_player 8.0.34.0
adobe flash_player 10.1.95.2
adobe flash_player 9.0.47.0
adobe flash_player 10.2.154.25
adobe flash_player 10.2.159.1
adobe flash_player 10.1.105.6
adobe flash_player 10.1.106.16
adobe flash_player 10.3.185.21
adobe flash_player 10.2.156.12
adobe flash_player 10.2.157.51

## # $Id$ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # web site for more information on licensing and terms of use # metasploitcom/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GreatRanking include Ms ...

This Metasploit module exploits a vulnerability in Adobe Flash Player versions 10318123 and earlier This issue is caused by a failure in the ActionScript3 AVM2 verification logic This results in unsafe JIT(Just-In-Time) code being executed This is the same vulnerability that was used for attacks against Korean based organizations Specificall ...

This module exploits a vulnerability in Adobe Flash Player versions 10.3.181.23 and earlier. This issue is caused by a failure in the ActionScript3 AVM2 verification logic. This results in unsafe JIT(Just-In-Time) code being executed. This is the same vulnerability that was used for attacks against Korean based organizations. Specifically, this issue occurs when indexing an array using an arbitrary value, memory can be referenced and later executed. Taking advantage of this issue does not rely on heap spraying as the vulnerability can also be used for information leakage. Currently this exploit works for IE6, IE7, IE8, Firefox 10.2 and likely several other browsers under multiple Windows platforms. This exploit bypasses ASLR/DEP and is very reliable.

msf > use exploit/windows/browser/adobe_flashplayer_arrayindexing
      msf exploit(adobe_flashplayer_arrayindexing) > show targets
            ...targets...
      msf exploit(adobe_flashplayer_arrayindexing) > set TARGET <target-id>
      msf exploit(adobe_flashplayer_arrayindexing) > show options
            ...show and set options...
      msf exploit(adobe_flashplayer_arrayindexing) > exploit

Zero Day Flaws Overvalued Says New Microsoft Report

Threatpost • Chris Brook • 11 Oct 2011

Attention given to previously unknown or “zero day” flaws may be overrated, according to research from Microsoft Corp.
In an analysis, “Zeroing in on Malware Propagation Methods,” Microsoft follows the propagation of malware and how certain forms measure up against other vulnerability exploits. Microsoft examined infections reported by their Malicious Software Removal Tool (MSRT), given the tool’s range and its connection to Windows/Microsoft Update.
While the...

CVE-2011-2110

Vulnerability Summary

Most Upvoted Vulmon Research Post

Vulnerability Trend

Exploits

Mailing Lists

Metasploit Modules

Recent Articles

References

Vulmon Search

About

Products

Connect