Websense Security Labs Blog  research methods miss.  Having fun
with Adobe 0-day exploits  View all posts >   Having fun with
Adobe 0-day exploits  Posted: 08 Jun 2010 06:56 PM | Anonymous |
no comments  We had some time to analyze the latest Adobe Flash
0-day exploit (CVE-2010-1297) floating around on the Internet.
By Googling the text inside the file, we found it was generated
from a benign SWF file inside the AES.zip file. This might mean
that the attacker used the SWF file for dummy fuzzing. We used
our custom SWF decoder to perform this SWF diffing operation.
The actual difference between the original file and the crashing
one is just one byte in the Action Script Byte code (DoABC tag
type). The original byte 0x66 was modified to 0x40.    Figure 1:
Diffing between original and exploit SWF records  You can look
up the AVM2 reference to see what each opcode means. The
original opcode 0x66 is "getproperty", while the modified opcode
0x40 means "newfunction".  We also confirmed this code
modification by usin