Adobe Shockwave Player tSAC Chunk Remote Memory Corruption Vulnerability

Bugtraq ID:	42665
Class:	Unknown
CVE:	CVE-2010-2866
Remote:	Yes
Local:	No
Published:	Aug 24 2010 12:00AM
Updated:	Aug 24 2010 12:00AM
Credit:	Aaron Portnoy, TippingPoint DVLabs
Vulnerable:	Adobe Shockwave Player 11.5.7 .609 Adobe Shockwave Player 11.5.6 .606 Adobe Shockwave Player 11.5.2 .606 Adobe Shockwave Player 11.5.2 .602 Adobe Shockwave Player 11.5.1 .601 Adobe Shockwave Player 11.5 .601 Adobe Shockwave Player 11.5 .600 Adobe Shockwave Player 11.5 .596
Not Vulnerable:	Adobe Shockwave Player 11.5.8.612

Adobe Shockwave Player tSAC Chunk Remote Memory Corruption Vulnerability

Adobe Shockwave Player is prone to a remote memory-corruption vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed attacks may cause a denial-of-service condition.

Adobe Shockwave Player 11.5.7.609 and prior are vulnerable.

NOTE: This issue was previously covered in BID 42657 (Adobe Shockwave Player APSB10-20 Multiple Remote Vulnerabilities) but has been given its own record to better document it.

Adobe Shockwave Player tSAC Chunk Remote Memory Corruption Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Adobe Shockwave Player tSAC Chunk Remote Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references for details.

Adobe Shockwave Player tSAC Chunk Remote Memory Corruption Vulnerability

References:

• Adobe Homepage (Adobe)
  
• Adobe Shockwave Director tSAC Chunk Remote Code Execution Vulnerability (Adobe)
  
• APSB10-20 Security update available for Shockwave Player (Adobe)