CVE-2013-0643

What is Adobe Flash Player?

Adobe Flash Player was a ubiquitous browser plugin enabling rich multimedia. Firefox's browser architecture includes a plugin sandbox — a security boundary around the Flash plugin process meant to limit what Flash can do even if exploited. The sandbox assigns permissions to the Flash process, and if those permissions are incorrect (too broad), a Flash vulnerability can be leveraged to escape the sandbox entirely. Adobe discontinued Flash Player on December 31, 2020.

Overview

CVE-2013-0643 is an incorrect default permissions vulnerability in Adobe Flash Player's Firefox plugin sandbox. The Firefox sandbox grants the Flash plugin process certain operating system permissions; the default permissions were set too broadly, allowing Flash code executing within the sandbox to perform privileged operations that should have been restricted. This permission misconfiguration was chained with CVE-2013-0648 (an ExternalInterface code execution flaw) to achieve a full sandbox escape — code execution inside Flash followed by exploitation of the excessive permissions to break out of Firefox's containment.

Adobe patched both vulnerabilities in Security Bulletin APSB13-08 on February 26, 2013.

Affected Versions

Technical Details

Firefox's plugin architecture runs the Flash plugin in a separate process with restricted permissions — a design intended to limit the damage if Flash is exploited. CVE-2013-0643 is specifically about the permissions granted to that Flash plugin process being misconfigured (incorrect defaults).

The attack chain works as follows:

1. CVE-2013-0648 achieves code execution inside the Flash plugin process (the sandboxed Flash process)
2. CVE-2013-0643 exploits the fact that the sandboxed Flash process has incorrect permissions — it can perform OS-level operations that a properly sandboxed process should be unable to do
3. Using these excessive permissions, the attacker's code escapes the Firefox sandbox and executes with full user-level privileges

This two-CVE chain is the Flash equivalent of the Adobe Reader CVE-2013-0640 + CVE-2013-0641 sandbox escape chain from the same month — demonstrating that multiple products' sandboxes were simultaneously being exploited by sophisticated actors.

Discovery

Discovered through analysis of zero-day exploits found in active targeted attack campaigns in February 2013.

Exploitation Context

CISA added this to the KEV catalog in September 2024, confirming historical confirmed exploitation. The CVE-2013-0643 + CVE-2013-0648 chain was used in targeted spear-phishing and water-holing attacks, delivering full code execution outside Firefox's plugin sandbox with no elevated privileges required from the victim.

Remediation

Adobe Flash Player reached end-of-life on December 31, 2020. Organizations should:

1. Verify Flash Player is completely removed from all endpoints
2. Check via endpoint management tools for any remaining Flash installations
3. Audit legacy systems that required Flash — replace or isolate these
4. Block .swf file delivery at email and web content filtering