responsive javascript flash player dectetion

Please note that Adobe labeled the vulnerability as critical and it affects the following applications:Īdobe Flash Player 10.0.45.2 and earlier versions for Windows, Macintosh, Linux and Solaris operating systemsĪdobe Reader and Acrobat 9.x for Windows, Macintosh and UNIX operating systems (because of the authplay.dll sub-component shipped with both applications).Īs of the moment of writing, there is no vendor patch to mitigate the attack. Some OS details are also collected, such as the User Information and administrators group, the Last Update Patches, Network Resources, Installed Applications, Installed Services and Browser Information The info include the local IP address, the DHCP server (if enabled), the SubNetMask, the Default Gateway, as well as the CPU type and its frequency. Once it is set in place, the dll file acts as a backdoor and starts sending critical information about the infected system to a remote server. A secondary DLL is also dropped in the %windows%system32 folder (overwriting a system file) and injected into an instance of SVCHOST.EXE. The dropped malicious file will subsequently trigger the download of an infected file from remote locations (the samples analyzed by BitDefender would attempt to connect to and download a file called xslu.exe). Here’s a short movie to demonstrate the attack

Upon its successful execution, the shell-code would decrypt and drop a binary file under the name c:-.exe. If the PDF file is opened within a browser (which is the most common scenario with links displayed on compromised web pages, forums, sent via e-mail or instant messaging), the embedded SWF file forces the heap-sprayed shell-code to be executed.

Once opened, the javascript triggers the decryption of a shell-code that will be subsequently heap-sprayed. Labeled as CVE-2010-1297, the exploit is currently exploited in the wild.

Just like the previous Adobe exploits we have written in the past, the attack vector is represented by a malformed PDF file that contains both a specially crafted javascript and an embedded.

The BitDefender Antimalware labs have just performed an emergency update to add detection for a zero-day exploit atack affecting the Adobe Reader, Acrobat and Flash Player applications.

Responsive javascript flash player dectetion