diff --git a/modules/exploits/windows/browser/adobe_flashplayer_avm.rb b/modules/exploits/windows/browser/adobe_flashplayer_avm.rb index fec7200dba..53111109be 100644 --- a/modules/exploits/windows/browser/adobe_flashplayer_avm.rb +++ b/modules/exploits/windows/browser/adobe_flashplayer_avm.rb @@ -12,7 +12,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote - Rank = NormalRanking + Rank = GoodRanking include Msf::Exploit::Remote::HttpServer::HTML @@ -26,7 +26,11 @@ class Metasploit3 < Msf::Exploit::Remote Specifically, this issue results in uninitialized memory being referenced and later executed. Taking advantage of this issue relies on heap spraying and controlling the - uninitialized memory. + uninitialized memory. + + Currently this exploit works for IE6, IE7, and Firefox 3.6 and likely several + other browsers. DEP does catch the exploit and causes it to fail. Due to the nature + of the uninitialized memory its fairly difficult to get around this restriction. }, 'License' => MSF_LICENSE, 'Author' =>