CVE-2013-0643
Adobe Flash Player Incorrect Default Permissions Vulnerability
Description
CVE-2013-0643 is a high-severity sandbox bypass vulnerability in the Firefox sandbox implementation of Adobe Flash Player. Affecting versions before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, this flaw improperly restricts privileges within the Flash Player sandbox. Exploited as a zero-day in February 2013, it was used in combination with CVE-2013-0648 to achieve remote code execution. With a CVSS score of 8.8 and an EPSS probability of 57.88% (98.1st percentile), CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 8, 2024.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | flash player | < 10.3.183.67; >= 11.0, < 11.6.602.171; >= 11.0, < 11.2.202.273 |
| redhat | enterprise linux desktop | 6.0 |
| redhat | enterprise linux eus | 5.9; 6.4 |
| redhat | enterprise linux server | 6.0 |
| redhat | enterprise linux server aus | 5.9; 6.4 |
| redhat | enterprise linux workstation | 6.0 |
| opensuse | opensuse | 11.4; 12.1 |
| suse | linux enterprise desktop | 10; 11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00025.html(Mailing List)
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00026.html(Mailing List)
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00035.html(Mailing List)
- http://rhn.redhat.com/errata/RHSA-2013-0574.html(Third Party Advisory)
- http://www.adobe.com/support/security/bulletins/apsb13-08.html(Broken Link, Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0643(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2013-0643 by NVD. The vulnerability is a privilege restriction bypass in the Firefox sandbox component of Adobe Flash Player. Adobe Flash Player implements a security sandbox that restricts the capabilities of Flash content based on the context in which it executes. In Firefox, a dedicated sandbox layer provides additional isolation for the Flash plugin. This vulnerability improperly restricts privileges within that sandbox, allowing Flash content to perform actions that should be blocked by the sandbox policy. The flaw enables attackers to weaken or bypass the security boundaries that are supposed to contain Flash content, serving as a prerequisite for further exploitation such as arbitrary code execution through companion vulnerabilities like CVE-2013-0648.
Impact Analysis
The impact of CVE-2013-0643 is severe when considered in the context of its real-world exploitation. Confidentiality is fully compromised because the sandbox bypass grants Flash content access to resources and data outside its intended security boundary, including browser data, local files, and system information that the sandbox should protect. Integrity is completely affected as the privilege escalation allows modification of browser settings, installation of persistent malware, and manipulation of the user's system beyond what sandboxed Flash content should ever be able to do. Availability faces high risk since the escaped Flash content can interact with the system at the user's privilege level, enabling denial-of-service attacks, system instability, and resource manipulation.
Although user interaction is required (visiting a page with malicious Flash content), targeted attacks effectively weaponized this requirement. The EPSS score of 57.88% (98.1st percentile) reflects significant and ongoing exploitation risk. The vulnerability was deliberately used as the first stage of a two-part exploit chain: CVE-2013-0643 weakened sandbox restrictions, and CVE-2013-0648 then leveraged the reduced protections to execute arbitrary code through ExternalInterface. The KEV entry lists ransomware association as "Unknown." The combination attack demonstrates sophisticated adversary tradecraft, where multiple vulnerabilities are chained for maximum impact.
Exploit Maturity
CVE-2013-0643 was actively exploited as a zero-day in February 2013 as part of a multi-vulnerability attack chain, representing full exploit maturity. CISA confirmed the active exploitation by including it in the KEV catalog with a remediation deadline of October 8, 2024. The EPSS score of 57.88% (98.1st percentile) indicates persistent exploitation relevance. The vulnerability was disclosed in Adobe Security Bulletin APSB13-08 alongside CVE-2013-0648, which it was paired with in real-world attacks. Threat actors combined the sandbox bypass from CVE-2013-0643 with the ExternalInterface code execution from CVE-2013-0648 to create a reliable exploit chain that escaped Flash Player's security sandbox and achieved arbitrary code execution on the victim's system. The ransomware association is listed as "Unknown" in the KEV catalog. While Flash Player has reached end of life, the exploit techniques demonstrated in these attacks informed subsequent Flash vulnerability research and exploitation methodologies.
Remediation
-
Remove Adobe Flash Player entirely from all systems. Flash Player reached end of life on December 31, 2020, and Adobe has ceased all security updates. Complete removal is the only effective remediation for this and all other Flash Player vulnerabilities.
-
Uninstall Flash Player from all browsers using Adobe's official uninstaller tool. For Linux systems, remove Flash using the package manager (e.g.,
apt remove flashplugin-installeroryum remove flash-plugin). Verify removal by checking browser plugin lists. -
Disable Flash in enterprise browser policies using Group Policy for Windows environments or managed browser configurations for cross-platform deployments. This provides a centralized way to prevent Flash execution even if the plugin remains installed on some systems.
-
Replace Flash-dependent internal applications with modern web technologies. Identify any internal tools, training modules, or content that still rely on Flash Player and migrate them to HTML5, CSS3, and JavaScript-based alternatives.
-
Implement browser isolation technology for users who must access legacy Flash content for legitimate business reasons. Browser isolation runs web content in a remote sandboxed environment, preventing any exploitation from reaching the user's actual system.
Technical Details
CVE-2013-0643 has a CVSS v3.1 base score of 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vector components are: Attack Vector (AV:N) confirms the vulnerability is exploitable over the network through web content. Attack Complexity (AC:L) indicates the exploit works reliably without special conditions. Privileges Required (PR:N) means the attacker needs no authentication. User Interaction (UI:R) requires the victim to visit a webpage containing the malicious Flash content. Scope (S:U) indicates the impact remains within the user's session context. Confidentiality (C:H), Integrity (I:H), and Availability (A:H) are all rated High.
The vulnerability targets the Firefox-specific sandbox implementation for the Adobe Flash Player NPAPI plugin. Firefox uses a plugin-container process with restricted privileges to isolate Flash content from the main browser process and the underlying operating system. CVE-2013-0643 exploits a flaw in how this sandbox enforces privilege restrictions, allowing Flash ActionScript code to perform operations that should be blocked by the sandbox policy. In the observed attack chain, the attacker first triggers CVE-2013-0643 to relax the sandbox constraints, then exploits CVE-2013-0648's ExternalInterface vulnerability to execute code that would otherwise be contained by the sandbox. The two-stage approach is necessary because ExternalInterface alone would be restricted by sandbox policies, while the sandbox bypass alone does not provide code execution — together they form a complete exploit chain from sandboxed Flash content to arbitrary code execution on the host system.
Frequently Asked Questions
What is CVE-2013-0643?
CVE-2013-0643 is a sandbox bypass vulnerability in Adobe Flash Player's Firefox sandbox implementation. It improperly restricts privileges, allowing malicious Flash content to perform actions outside the intended security boundary. It was exploited as a zero-day in February 2013.
How does this vulnerability relate to CVE-2013-0648?
The two vulnerabilities were used together in real-world attacks. CVE-2013-0643 bypasses the Firefox sandbox restrictions for Flash Player, and CVE-2013-0648 exploits a flaw in ExternalInterface to execute arbitrary code. The sandbox bypass was necessary because the ExternalInterface exploit would otherwise be contained by the sandbox's privilege restrictions.
Why is a 2013 vulnerability still in the CISA KEV catalog?
CISA maintains historical vulnerabilities in the KEV catalog because they remain exploitable on systems that have not been remediated. Flash Player may still be installed on legacy systems, kiosks, or embedded devices. The KEV listing serves as a formal notice to federal agencies and organizations to ensure complete remediation.
What is the best way to protect against this vulnerability?
The definitive protection is complete removal of Adobe Flash Player from all systems. Since Flash Player reached end of life in December 2020 and receives no security updates, there are no patches available. Uninstall Flash Player and migrate any Flash-dependent applications to modern alternatives.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.