信息网络安全

信息网络安全 ›› 2014, Vol. 14 ›› Issue (10): 31-37.doi: 10.3969/j.issn.1671-1122.2014.10.006

• 技术研究 • 上一篇    下一篇

典型Adobe Flash Player漏洞简介与原理分析

孟正, 曾天宁, 马洋洋, 文伟平   

  1. 北京大学软件与微电子学院,北京 102600
  • 收稿日期:2014-06-06 出版日期:2014-10-01 发布日期:2015-08-17
  • 作者简介:

    孟正（1990-）,男,河北,硕士研究生,主要研究方向：漏洞分析和漏洞挖掘;曾天宁（1990-）,男,山东,硕士研究生,主要研究方向：网络与系统安全;马洋洋（1989-）,男,山东,硕士研究生,主要研究方向：网络与系统安全;文伟平（1976-）,男,湖南,副教授,博士,主要研究方向：网络攻击与防范、恶意代码研究、信息系统逆向工程和可信计算技术等。

  • 基金资助:
    国家自然科学基金[61170282]

Introduction and Analysis of Adobe Flash Player Vulnerabilities

MENG Zheng, ZENG Tian-ning, MA Yang-yang, WEN Wei-ping   

  1. School of Software&Microelectronics, Peking University, Beijing 102600, China
  • Received:2014-06-06 Online:2014-10-01 Published:2015-08-17

RichHTML

7

PDF (PC)

113

摘要：

随着Flash文件在网络上的应用日益广泛,Adobe Flash Player的安全问题受到人们越来越多的关注,它的每一个漏洞都有引发巨大安全问题的可能性。文章首先从Flash客户端技术和Flash三维可视化分析两个方面对Adobe Flash Player的运行机制进行了介绍,研究了ActionScript语言、Flash渲染模型、事件机制、Flash三维图形显示、Stage3D硬件加速和Stage3D三维建模的特性;接下来描述了SWF文件的格式信息,对SWF文件的文件头和标签结构进行介绍;然后结合CVE网站的统计信息,对Adobe Flash Player漏洞进行分类,将其划分为Flash文件格式漏洞、Flash拒绝服务漏洞、Flash跨站脚本攻击漏洞和Flash欺骗攻击漏洞等4大类;随后对漏洞分析技术进行了详细介绍,建立了针对Adobe Flash Player的漏洞分析技术模型;最后以10个典型的Adobe Flash Player漏洞作为实例,经过信息收集、数据流跟踪和漏洞原理分析等过程,得到了漏洞的产生机理。

关键词: Adobe Flash Player, 漏洞分类, 漏洞分析, SWF文件格式

Abstract:

As the application of Flash file in the network is becoming more and more wide, the security problems of Adobe Flash Player have also attracted more and more attentions. Every vulnerability has a possibility to arise serious security problem. This dissertation first describes the operation mechanism of Adobe Flash Player from the two aspects of Flash client technology and Flash 3D visualization analysis, gives a research on the characters of ActionScript language, Flash rendering model, event mechanism, Flash three dimensional graphic display, Stage3D hardware speeding and Stage3D modeling. Then the format of SWF file is described, and the file heading and the label structure are introduced. Combining with the statistic information of CVE website, the article takes a classification on the vulnerabilities of Adobe Flash Player. These four types of vulnerabilities are Flash file format vulnerability, Flash service denial vulnerability, Flash cross site scripting vulnerability and Flash spoofing attack vulnerability. Then the vulnerabilities classification method and the vulnerabilities analysis technology of Adobe Flash Player are described in detail and the technical model for vulnerability analysis targeting on Adobe Flash Player is built up. At last, ten typical vulnerabilities in Adobe Flash Player are taken as the practical examples. After the processes of information collection, data flow tracking and vulnerability principle analysis, the vulnerability production mechanism is drawn out finally.

Key words: Adobe Flash Player, vulnerabilities classification, vulnerabilities analysis, SWF file format

中图分类号: