RETIRED: Adobe Shockwave Player APSB11-01 Multiple Remote Vulnerabilities
BID:46284
Info
RETIRED: Adobe Shockwave Player APSB11-01 Multiple Remote Vulnerabilities
| Bugtraq ID: | 46284 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 08 2011 12:00AM |
| Updated: | Feb 11 2011 03:50PM |
| Credit: | Carsten Eiram of Secunia Research, Krystian Kloskowski (h07), Will Dormann of CERT/CC, Andrzej Dyjak of iDefense Labs, Logan Brown and Aaron Portnoy with TippingPoint DVLabs, Aniway and Luigi Auriemma through TippingPoint's Zero Day Initiative, an anonymou |
| Vulnerable: |
Adobe Shockwave Player 11.5.7 .609 Adobe Shockwave Player 11.5.6 .606 Adobe Shockwave Player 11.5.2 .606 Adobe Shockwave Player 11.5.2 .602 Adobe Shockwave Player 11.5.1 .601 Adobe Shockwave Player 11.5 .601 Adobe Shockwave Player 11.5 .600 Adobe Shockwave Player 11.5 .596 Adobe Shockwave Player 11.5.9.615 Adobe Shockwave Player 11.5.8.612 Adobe Shockwave Player 11.5.0.595 Adobe Shockwave Player 11.0.3.471 Adobe Shockwave Player 11.0.0.456 Adobe Shockwave Player 11 |
| Not Vulnerable: |
Adobe Shockwave Player 11.5.9.620 |
Discussion
RETIRED: Adobe Shockwave Player APSB11-01 Multiple Remote Vulnerabilities
Adobe Shockwave Player is prone to multiple remote vulnerabilities.
Attackers can exploit these issues to crash the affected application and execute arbitrary code within the context of the affected application.
Adobe Shockwave Player versions prior to 11.5.9.620 are vulnerable.
This BID is being retired. The following individual records exist to better document the issues:
46316 Adobe Shockwave Player 'dirapi.dll' Module Memory Corruption Remote Code Execution Vulnerability
46317 Adobe Shockwave Player Director File Memory Corruption Remote Code Execution Vulnerability
46318 Adobe Shockwave Player 'dirapi.dll' Module CVE-2010-2588 Remote Code Execution Vulnerability
46319 Adobe Shockwave Player 'dirapi.dll' Module Memory Corruption Remote Code Execution Vulnerability
46320 Adobe Shockwave Player 'IML32' Module Memory Corruption Remote Code Execution Vulnerability
46321 Adobe Shockwave Player CVE-2010-4093 Memory Corruption Remote Code Execution Vulnerability
46324 Adobe Shockwave Player 'CSWV' Chunk Memory Corruption Remote Code Execution Vulnerability
46325 Adobe Shockwave Player Unspecified Memory Corruption Remote Code Execution Vulnerability
46326 Adobe Shockwave Player 3D Parsing Routine Memory Corruption Remote Code Execution Vulnerability
46327 Adobe Shockwave Player 'TextXtra.x32' Module Memory Corruption Remote Code Execution Vulnerability
46328 Adobe Shockwave Player 'Xtra.x32' Module Memory Corruption Remote Code Execution Vulnerability
46329 Adobe Shockwave Player 'dirapi.dll' Module Integer Overflow Remote Code Execution Vulnerability
46330 Adobe Shockwave Player 3D Assets Module Integer Overflow Remote Code Execution Vulnerability
46332 Adobe Shockwave Player 'Xtra.x32' Module (CVE-2011-0569) Remote Code Execution Vulnerability
46333 Adobe Shockwave Player CVE-2010-4306 Memory Corruption Remote Code Execution Vulnerability
46334 Adobe Shockwave Player CVE-2010-4193 Input Validation Remote Code Execution Vulnerability
46335 Adobe Shockwave Player 'dirapi.dll' Module Input Validation Remote Code Execution Vulnerability
46336 Adobe Shockwave Player 'TextXtra' Module Input Validation Remote Code Execution Vulnerability
46338 Adobe Shockwave Player 3D Assets Module Input Validation Remote Code Execution Vulnerability
46339 Adobe Shockwave Player Unspecified Buffer Overflow Remote Code Execution Vulnerability
Adobe Shockwave Player is prone to multiple remote vulnerabilities.
Attackers can exploit these issues to crash the affected application and execute arbitrary code within the context of the affected application.
Adobe Shockwave Player versions prior to 11.5.9.620 are vulnerable.
This BID is being retired. The following individual records exist to better document the issues:
46316 Adobe Shockwave Player 'dirapi.dll' Module Memory Corruption Remote Code Execution Vulnerability
46317 Adobe Shockwave Player Director File Memory Corruption Remote Code Execution Vulnerability
46318 Adobe Shockwave Player 'dirapi.dll' Module CVE-2010-2588 Remote Code Execution Vulnerability
46319 Adobe Shockwave Player 'dirapi.dll' Module Memory Corruption Remote Code Execution Vulnerability
46320 Adobe Shockwave Player 'IML32' Module Memory Corruption Remote Code Execution Vulnerability
46321 Adobe Shockwave Player CVE-2010-4093 Memory Corruption Remote Code Execution Vulnerability
46324 Adobe Shockwave Player 'CSWV' Chunk Memory Corruption Remote Code Execution Vulnerability
46325 Adobe Shockwave Player Unspecified Memory Corruption Remote Code Execution Vulnerability
46326 Adobe Shockwave Player 3D Parsing Routine Memory Corruption Remote Code Execution Vulnerability
46327 Adobe Shockwave Player 'TextXtra.x32' Module Memory Corruption Remote Code Execution Vulnerability
46328 Adobe Shockwave Player 'Xtra.x32' Module Memory Corruption Remote Code Execution Vulnerability
46329 Adobe Shockwave Player 'dirapi.dll' Module Integer Overflow Remote Code Execution Vulnerability
46330 Adobe Shockwave Player 3D Assets Module Integer Overflow Remote Code Execution Vulnerability
46332 Adobe Shockwave Player 'Xtra.x32' Module (CVE-2011-0569) Remote Code Execution Vulnerability
46333 Adobe Shockwave Player CVE-2010-4306 Memory Corruption Remote Code Execution Vulnerability
46334 Adobe Shockwave Player CVE-2010-4193 Input Validation Remote Code Execution Vulnerability
46335 Adobe Shockwave Player 'dirapi.dll' Module Input Validation Remote Code Execution Vulnerability
46336 Adobe Shockwave Player 'TextXtra' Module Input Validation Remote Code Execution Vulnerability
46338 Adobe Shockwave Player 3D Assets Module Input Validation Remote Code Execution Vulnerability
46339 Adobe Shockwave Player Unspecified Buffer Overflow Remote Code Execution Vulnerability
Exploit / POC
RETIRED: Adobe Shockwave Player APSB11-01 Multiple Remote Vulnerabilities
Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
RETIRED: Adobe Shockwave Player APSB11-01 Multiple Remote Vulnerabilities
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
RETIRED: Adobe Shockwave Player APSB11-01 Multiple Remote Vulnerabilities
References:
References:
- Adobe Homepage (Adobe)
- iDefense Security Advisory 02.08.11: Adobe Shockwave Player Memory Corruption V (labs-no-reply
- Adobe Shockwave Player Memory Corruption Vulnerability (iDefense)
- APSB11-01 Security update available for Shockwave Player (Adobe)
- TPTI-11-01 Adobe Shockwave dirapi.dll IFWV Trusted Offset Remote Code Execution (Tipping Point)
- TPTI-11-02 Adobe Shockwave TextXtra Invalid Seek Remote Code Execution Vulnerabi (Tipping Point)
- TPTI-11-03 Adobe Shockwave Font Xtra String Decoding Remote Code Execution Vulne (Tipping Point)
- TPTI-11-04 Adobe Shockwave GIF Logical Screen Descriptor Parsing Remote Code Exe (Tipping Point)
- TPTI-11-05 Adobe Shockwave PFR1 Font Chunk Parsing Remote Code Execution Vulnera (Tipping Point)
- ZDI-11-078-Adobe Shockwave Player FFFFFF88 Record Count Element Remote Code Exec (Zero Day Initiative)
- ZDI-11-079-Adobe Shockwave Player 0xFFFFFF45 Record Count Element Remote Code Ex (Zero Day Initiative)
- ZDI-11-080 Adobe Shockwave CSWV Chunk Substructure Offset Value Remote Code Exec (Zero Day Initiative)