Adobe Shockwave Player Unspecified Buffer Overflow Remote Code Execution Vulnerability

Bugtraq ID:	46339
Class:	Unknown
CVE:	CVE-2010-4307
Remote:	Yes
Local:	No
Published:	Feb 08 2011 12:00AM
Updated:	Feb 08 2011 12:00AM
Credit:	IBM X-Force
Vulnerable:	Adobe Shockwave Player 11.5.7 .609 Adobe Shockwave Player 11.5.6 .606 Adobe Shockwave Player 11.5.2 .606 Adobe Shockwave Player 11.5.2 .602 Adobe Shockwave Player 11.5.1 .601 Adobe Shockwave Player 11.5 .601 Adobe Shockwave Player 11.5 .600 Adobe Shockwave Player 11.5 .596 Adobe Shockwave Player 11.5.9.615 Adobe Shockwave Player 11.5.8.612 Adobe Shockwave Player 11.5.0.595 Adobe Shockwave Player 11.0.3.471 Adobe Shockwave Player 11.0.0.456 Adobe Shockwave Player 11
Not Vulnerable:	Adobe Shockwave Player 11.5.9.620

Adobe Shockwave Player Unspecified Buffer Overflow Remote Code Execution Vulnerability

Adobe Shockwave Player is prone to a remote code-execution vulnerability.

Attackers can exploit this issue to execute arbitrary code within the context of the user running the affected application. Failed attempts will likely cause a denial-of-service condition.

Versions prior to Shockwave Player 11.5.9.620 are vulnerable.

NOTE: This issue was originally discussed in BID 46284 (Adobe Shockwave Player APSB11-01 Multiple Remote Vulnerabilities) but has been given its own record to better document it.

Adobe Shockwave Player Unspecified Buffer Overflow Remote Code Execution Vulnerability

Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Adobe Shockwave Player Unspecified Buffer Overflow Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for details.

Adobe Shockwave Player Unspecified Buffer Overflow Remote Code Execution Vulnerability

References:

• Adobe Homepage (Adobe)
  
• APSB11-01 Security update available for Shockwave Player (Adobe)