3 ms·
I'm no security researcher, but the proof of concept looks like there just exists this API where you get to set a memory address and call from a limited pool of
by CGamesPlay 12y ago
I'm no security researcher, but the proof of concept looks like there just exists this API where you get to set a memory address and call from a limited pool of functions. Based on that observation, this hardly seems like an exploit--it looks like "as designed". What made Adobe/Macromedia/whoever originally decide that this interface was "secure"? Am I missing something?
- jbangert 12y agoWell, the ability to call a set of functions (really, to overwrite a vtable pointer with a constrained set of values - which is a table of function pointers your C++ compiler emits to handle virtual function calls) is the underlying vulnerability. The article describes a proof of concept exploit - an approach of turning this into a concrete security problem (arbitrary command execution/calling libc).
- comex 12y agoNot sure what you mean. The native data field is a union, and its interpretation depends on the type of object. When the native function object is created, it can be set to an arbitrary integer, and when it's used as intended, it's interpreted as such, as the post says, "generally in a switch statement to further direct the call". When a NetConnection object is created, it's set to a non-arbitrary pointer by the constructor and interpreted as such. The issue is tricking the NetConnection implementation to use the native data of a native function object instead of a real NetConnection object.