Adobe Shockwave Player Multiple Integer Overflow Vulnerabilities

Bugtraq ID:	37872
Class:	Boundary Condition Error
CVE:	CVE-2009-4003
Remote:	Yes
Local:	No
Published:	Jan 19 2010 12:00AM
Updated:	Jan 20 2010 09:31AM
Credit:	Alin Rad Pop of Secunia Research
Vulnerable:	Adobe Shockwave Player 11.5.2 .602 Adobe Shockwave Player 11.5.1 .601 Adobe Shockwave Player 11.5 .601 Adobe Shockwave Player 11.5 .600 Adobe Shockwave Player 11.5 .596 Adobe Shockwave Player 10.2 .023 Adobe Shockwave Player 10
Not Vulnerable:	Adobe Shockwave Player 11.5.2 .606

Adobe Shockwave Player Multiple Integer Overflow Vulnerabilities

Adobe Shockwave Player is prone to multiple integer-overflow vulnerabilities.

Attackers can exploit these issues to execute arbitrary code in the context of the currently logged-in user. Failed attacks may cause denial-of-service conditions.

Versions prior to Shockwave Player 11.5.2.606 for Microsoft Windows and Apple Mac OS X are vulnerable.

Adobe Shockwave Player Multiple Integer Overflow Vulnerabilities

Solution:
The vendor has released an advisory and updates. Please see the references for details.

Adobe Shockwave Player Multiple Integer Overflow Vulnerabilities

References:

• Secunia Research: Adobe Shockwave Player 3D Model Two Integer Overflows (Secunia Research)
  
• Adobe Shockwave Player Homepage (Adobe)
  
• Secunia Research: Adobe Shockwave Player Four Integer Overflow Vulnerabilities (Secunia Research)
  
• Secunia Research: Adobe Shockwave Player Integer Overflow Vulnerability (Secunia Research)
  
• Adobe - Security Bulletins: APSB10-03 Security update available for Shockwave Pl (Adobe)