Adobe Shockwave Player rcsL Chunk EAX Register Memory Corruption Vulnerability

Bugtraq ID:	44291
Class:	Unknown
CVE:	CVE-2010-3653
Remote:	Yes
Local:	Yes
Published:	Oct 21 2010 12:00AM
Updated:	Oct 28 2010 06:58PM
Credit:	Abysssec
Vulnerable:	Adobe Shockwave Player 11.5.7 .609 Adobe Shockwave Player 11.5.6 .606 Adobe Shockwave Player 11.5.2 .606 Adobe Shockwave Player 11.5.2 .602 Adobe Shockwave Player 11.5.1 .601 Adobe Shockwave Player 11.5 .601 Adobe Shockwave Player 11.5 .600 Adobe Shockwave Player 11.5 .596 Adobe Shockwave Player 11.5.8.612 Adobe Shockwave Player 11.5.0.595 Adobe Shockwave Player 11.0.0.456 Adobe Shockwave Player 11
Not Vulnerable:	Adobe Shockwave Player 11.5.9.615

Adobe Shockwave Player rcsL Chunk EAX Register Memory Corruption Vulnerability

Adobe Shockwave Player is prone to a memory-corruption vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed attacks may cause a denial-of-service condition.

Adobe Shockwave Player 11.5.8.612 is vulnerable; other versions may also be affected.

Adobe Shockwave Player rcsL Chunk EAX Register Memory Corruption Vulnerability

The vendor confirms that this issue is being exploited in the wild.

The following exploit is available:

• /data/vulnerabilities/exploits/44291.zip

Adobe Shockwave Player rcsL Chunk EAX Register Memory Corruption Vulnerability

Solution:
Updates are available; please see the references for more information.

Adobe Shockwave Player rcsL Chunk EAX Register Memory Corruption Vulnerability

References:

• Adobe Homepage (Adobe)
  
• Adobe Shockwave Player Homepage (Adobe)
  
• APSA10-04:Security Advisory for Adobe Shockwave Player (Adobe)
  
• APSB10-25 Security update available for Shockwave Player (Adobe)