CVE-2011-0611

Deeper analysis

CVE-2011-0611 is a type confusion vulnerability (CWE-843) in the handling of Flash content that manifests through a size inconsistency in a "group of included constants," custom ActionScript prototype modifications, and improper Date object processing. It affects Adobe Flash Player versions before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris (and 10.2.156.12 and earlier on Android), Adobe AIR before 2.6.19140, and the Authplay.dll/AuthPlayLib.bundle component in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows as well as corresponding versions of Reader and Acrobat on Mac OS X.

Remote attackers can exploit the flaw by delivering crafted .swf content, including Microsoft Office documents containing embedded Flash objects, to trigger arbitrary code execution or an application crash. Successful exploitation grants the attacker the ability to run code in the context of the affected process without requiring authentication beyond normal user interaction such as opening a malicious document or viewing a web page.

Publicly available analyses and vendor bulletins from April 2011 document in-the-wild exploitation and recommend immediate application of the vendor-supplied updates that raise Flash Player, AIR, Reader, and Acrobat to the fixed versions listed in the CVE description. Several distributions and browser vendors also issued coordinated advisories to accelerate patching or temporarily restrict Flash execution.

The vulnerability was actively exploited in April 2011, with multiple public write-ups detailing weaponized samples that combined the type confusion primitive with ROP chains to achieve reliable code execution.