Adobe Shockwave Player CVE-2010-2864 Remote Memory Corruption Vulnerability

Bugtraq ID:	42666
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2010-2864
Remote:	Yes
Local:	No
Published:	Aug 24 2010 12:00AM
Updated:	Sep 01 2010 06:35PM
Credit:	Honggang Ren of Fortinet's FortiGuard Labs
Vulnerable:	Adobe Shockwave Player 11.5.7 .609 Adobe Shockwave Player 11.5.6 .606 Adobe Shockwave Player 11.5.2 .606 Adobe Shockwave Player 11.5.2 .602 Adobe Shockwave Player 11.5.1 .601 Adobe Shockwave Player 11.5 .601 Adobe Shockwave Player 11.5 .600 Adobe Shockwave Player 11.5 .596
Not Vulnerable:	Adobe Shockwave Player 11.5.8.612

Adobe Shockwave Player CVE-2010-2864 Remote Memory Corruption Vulnerability

Adobe Shockwave Player is prone to a remote memory-corruption vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed attacks may cause a denial-of-service condition.

Adobe Shockwave Player 11.5.7.609 and prior are vulnerable.

NOTE: This issue was previously covered in BID 42657 (Adobe Shockwave Player APSB10-20 Multiple Remote Vulnerabilities) but has been given its own record to better document it.

Adobe Shockwave Player CVE-2010-2864 Remote Memory Corruption Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

A proof of concept is available from the reporter. Please see the references for more information.

Adobe Shockwave Player CVE-2010-2864 Remote Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references for details.

Adobe Shockwave Player CVE-2010-2864 Remote Memory Corruption Vulnerability

References:

• Adobe Homepage (Adobe)
  
• Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-2864 (Rodrigo Branco )
  
• APSB10-20 Security update available for Shockwave Player (Adobe)