Adobe Shockwave Player DIR File Parsing Remote Code Execution Vulnerabilities

Bugtraq ID:	40081
Class:	Unknown
CVE:	CVE-2010-1280
Remote:	Yes
Local:	No
Published:	May 11 2010 12:00AM
Updated:	May 12 2010 05:22PM
Credit:	Gjoko 'LiquidWorm' Krstic
Vulnerable:	Adobe Shockwave Player 11.5.6 .606 Adobe Shockwave Player 11.5.2 .606 Adobe Shockwave Player 11.5.2 .602 Adobe Shockwave Player 11.5.1 .601 Adobe Shockwave Player 11.5 .601 Adobe Shockwave Player 11.5 .600 Adobe Shockwave Player 11.5 .596
Not Vulnerable:	Adobe Shockwave Player 11.5.7 .609

Adobe Shockwave Player DIR File Parsing Remote Code Execution Vulnerabilities

Adobe Shockwave Player is prone to multiple remote code-execution vulnerabilities caused by memory-corruption errors while parsing Director (.dir) files.

Attackers can exploit these issues to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts may cause a denial-of-service condition.

Versions prior to Shockwave Player 11.5.7.609 are vulnerable.

NOTE: These issues were previously covered in BID 40066 (Adobe Shockwave Player APSB10-12 Multiple Remote Vulnerabilities); they have been given their own record to better document them.

Adobe Shockwave Player DIR File Parsing Remote Code Execution Vulnerabilities

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/40081.c

Adobe Shockwave Player DIR File Parsing Remote Code Execution Vulnerabilities

Solution:
Updates are available. Please see the references for details.

Adobe Shockwave Player DIR File Parsing Remote Code Execution Vulnerabilities

References:

• Adobe Security Advisory APSB10-12 (Adobe)
  
• Adobe Shockwave Player Homepage (Adobe)
  
• [CAL-20100204-3]Adobe Shockwave Player Director File Parsing RCSL Pointer Overwr (Code Audit Labs )