Adobe Shockwave Player CVE-2010-0127 3D Parsing Remote Code Execution Vulnerability

Bugtraq ID:	40083
Class:	Boundary Condition Error
CVE:	CVE-2010-0127
Remote:	Yes
Local:	No
Published:	May 11 2010 12:00AM
Updated:	May 12 2010 04:41PM
Credit:	Alin Rad Pop of Secunia Research.
Vulnerable:	Adobe Shockwave Player 11.5.6 .606 Adobe Shockwave Player 11.5.2 .606 Adobe Shockwave Player 11.5.2 .602 Adobe Shockwave Player 11.5.1 .601 Adobe Shockwave Player 11.5 .601 Adobe Shockwave Player 11.5 .600 Adobe Shockwave Player 11.5 .596
Not Vulnerable:	Adobe Shockwave Player 11.5.7 .609

Adobe Shockwave Player CVE-2010-0127 3D Parsing Remote Code Execution Vulnerability

Adobe Shockwave Player is prone to a remote code-execution vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Adobe Shockwave Player 11.5.6.606 and prior are vulnerable.

NOTE: This issue was previously discussed in BID 40066 (Adobe Shockwave Player APSB10-12 Multiple Remote Vulnerabilities) but has been given its own record to better document it.

Adobe Shockwave Player CVE-2010-0127 3D Parsing Remote Code Execution Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Adobe Shockwave Player CVE-2010-0127 3D Parsing Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for details.

Adobe Shockwave Player CVE-2010-0127 3D Parsing Remote Code Execution Vulnerability

References:

• Adobe Homepage (Adobe)
  
• Adobe Security Advisory APSB10-12 (Adobe)
  
• Adobe Shockwave Player 3D Parsing Memory Corruption (Secunia)