VIR Vulnerability Intelligence Relay

CVE-2015-3081

medium
Published 2015-05-13 · Modified 2026-05-06
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
5.3

Description

Race condition in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allows attackers to bypass the Internet Explorer Protected Mode protection mechanism via unspecified vectors.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-37842 remote windows verified text · 1 KB
KeenTeam · 2015-08-19

Flash Broker-Based - Sandbox Escape via Timing Attack Against File Moving

text exploit Source: Exploit-DB 
Source: https://code.google.com/p/google-security-research/issues/detail?id=280&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

FlashBroker - BrokerMoveFileEx TOCTOU IE PM Sandbox Escape

1. Windows 8.1 Internet Explorer Protected Mode Bypass in FlashBroker

FlashBroker is vulnerable to NTFS junction attack to write an arbitrary file to the filesystem under user permissions.

There is a race condition in FlashBroker BrokerMoveFileEx method. This race can be won by using an oplock to wait for the point where the BrokerMoveFileEx method opens the original file and then making destination to be a junction.

The PoC writes calc.bat to startup folder. It has been tested by injecting the dll into 32-bit low integrity level IE process with Adobe Flash Player 16.0.0.305 (KB3021953) installed. It does not work in IE11 EPM as it needs to write normally to the temporary folder to setup the junction.

2. Credit
Jihui Lu of KeenTeam (@K33nTeam) is credited for the vulnerability.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37842.zip

OS impact
linux Linux kernel Fixed 1 release
VersionStatusFixed in
- Not affected —
macos macOS Fixed 1 release
VersionStatusFixed in
- Not affected —

Application impact
VendorProductVersionsFixed
adobe adobeflash_player{"endIncluding":"11.2.202.475"}
adobe adobeair{"endIncluding":"17.0.0.144"}
adobe adobeair_sdk{"endIncluding":"17.0.0.144"}
adobe adobeair_sdk_\&_compiler{"endIncluding":"17.0.0.144"}
adobe adobeflash_player14.0.0.125
adobe adobeflash_player14.0.0.145
adobe adobeflash_player14.0.0.176
adobe adobeflash_player14.0.0.179
adobe adobeflash_player15.0.0.152
adobe adobeflash_player15.0.0.167
adobe adobeflash_player15.0.0.189
adobe adobeflash_player15.0.0.223
adobe adobeflash_player15.0.0.239
adobe adobeflash_player15.0.0.246
adobe adobeflash_player16.0.0.235
adobe adobeflash_player16.0.0.257
adobe adobeflash_player16.0.0.287
adobe adobeflash_player16.0.0.296
adobe adobeflash_player17.0.0.134
adobe adobeflash_player17.0.0.169

References

CWEs

CWE-362

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.