4 ms·

A Tale of Two Exploits

44 points by 2510c39011c5 12y ago

SloopJon 12y ago
I'm not familiar with the term bug collision, and I don't quite grok it from context. Is this another way of saying independent discovery?
- rudolf0 12y ago
  Yes.
CGamesPlay 12y ago
I'm no security researcher, but the proof of concept looks like there just exists this API where you get to set a memory address and call from a limited pool of functions. Based on that observation, this hardly seems like an exploit--it looks like "as designed". What made Adobe/Macromedia/whoever originally decide that this interface was "secure"? Am I missing something?
- jbangert 12y ago
  Well, the ability to call a set of functions (really, to overwrite a vtable pointer with a constrained set of values - which is a table of function pointers your C++ compiler emits to handle virtual function calls) is the underlying vulnerability. The article describes a proof of concept exploit - an approach of turning this into a concrete security problem (arbitrary command execution/calling libc).
- comex 12y ago
  Not sure what you mean. The native data field is a union, and its interpretation depends on the type of object. When the native function object is created, it can be set to an arbitrary integer, and when it's used as intended, it's interpreted as such, as the post says, "generally in a switch statement to further direct the call". When a NetConnection object is created, it's set to a non-arbitrary pointer by the constructor and interpreted as such. The issue is tricking the NetConnection implementation to use the native data of a native function object instead of a real NetConnection object.
quanticle 12y ago
This is a quintessential example of why it's a very bad thing for the NSA to hoard zero-days. It's easy to forget that the black hats are looking for zero days too, and the fact that you've found an undisclosed vulnerability doesn't mean that that you're the the only one to have found this vulnerability, or even that you're the first one. In the example from the article, it's likely that the black hats found the zero day first, and were in the process of updating their attack toolkits when the Project Zero team came across the issue and notified Adobe. If it had been the NSA that found this issue, no one would have been notified, and the black hats would have had days or weeks to refine their attacks before a patch was issued.

44 points by 2510c39011c5 12y ago

I'm not familiar with the term bug collision, and I don't quite grok it from context. Is this another way of saying independent discovery?

rudolf0 12y ago
Yes.

CGamesPlay 12y ago

I'm no security researcher, but the proof of concept looks like there just exists this API where you get to set a memory address and call from a limited pool of functions. Based on that observation, this hardly seems like an exploit--it looks like "as designed". What made Adobe/Macromedia/whoever originally decide that this interface was "secure"? Am I missing something?

jbangert 12y ago
Well, the ability to call a set of functions (really, to overwrite a vtable pointer with a constrained set of values - which is a table of function pointers your C++ compiler emits to handle virtual function calls) is the underlying vulnerability. The article describes a proof of concept exploit - an approach of turning this into a concrete security problem (arbitrary command execution/calling libc).
comex 12y ago
Not sure what you mean. The native data field is a union, and its interpretation depends on the type of object. When the native function object is created, it can be set to an arbitrary integer, and when it's used as intended, it's interpreted as such, as the post says, "generally in a switch statement to further direct the call". When a NetConnection object is created, it's set to a non-arbitrary pointer by the constructor and interpreted as such. The issue is tricking the NetConnection implementation to use the native data of a native function object instead of a real NetConnection object.

quanticle 12y ago

This is a quintessential example of why it's a very bad thing for the NSA to hoard zero-days. It's easy to forget that the black hats are looking for zero days too, and the fact that you've found an undisclosed vulnerability doesn't mean that that you're the the only one to have found this vulnerability, or even that you're the first one. In the example from the article, it's likely that the black hats found the zero day first, and were in the process of updating their attack toolkits when the Project Zero team came across the issue and notified Adobe. If it had been the NSA that found this issue, no one would have been notified, and the black hats would have had days or weeks to refine their attacks before a patch was issued.