FILE-FLASH -- Snort has detected suspicious traffic via the Adobe Flash Player. Flash is a common target of code execution, overflow, DoS, and memory corruption attacks in particular, via swifs, action scripts, etc. Many networks block Flash altogether; the application will be deprecated in 2020.
FILE-FLASH Adobe Flash Player AVM domain memory range integer overflow attempt
The rule looks for specific functions that regulate access to memory and in conjuciton, can cause the check on memory access to be bypassed.
What To Look For
This rule alerts when Snort detects the download of a PDF file with functions use to setup memory corruption
No public information
No known false positives
Talos research team.
MITRE ATT&CK Framework
Technique: Exploitation for Client Execution
For reference, see the MITRE ATT&CK vulnerability types here:
Memory Corruption is any vulnerability that allows the modification of the content of memory locations in a way not intended by the developer. Memory corruption results are inconsistent; they could lead to fatal errors and system crashes or data leakage; some have no effect at all.
CVE Additional Information
CVE-2015-8651Integer overflow in Adobe Flash Player before 184.108.40.2064 and 19.x and 20.x before 220.127.116.117 on Windows and OS X and before 18.104.22.1689 on Linux, Adobe AIR before 22.214.171.124, Adobe AIR SDK before 126.96.36.199, and Adobe AIR SDK & Compiler before 188.8.131.52 allows attackers to execute arbitrary code via unspecified vectors.
||Ease of Access||