Adobe Shockwave Player CVE-2012-0758 DIR File Handling Remote Heap Overflow Vulnerability

Bugtraq ID:	52007
Class:	Boundary Condition Error
CVE:	CVE-2012-0758
Remote:	Yes
Local:	No
Published:	Feb 14 2012 12:00AM
Updated:	Feb 15 2012 06:50AM
Credit:	instruder of Code Audit Labs of vulnhunt.com
Vulnerable:	Adobe Shockwave Player 11.5.7 .609 Adobe Shockwave Player 11.5.6 .606 Adobe Shockwave Player 11.5.2 .606 Adobe Shockwave Player 11.5.2 .602 Adobe Shockwave Player 11.5.1 .601 Adobe Shockwave Player 11.5 .601 Adobe Shockwave Player 11.5 .600 Adobe Shockwave Player 11.5 .596 Adobe Shockwave Player 10.2 .023 Adobe Shockwave Player 11.6.3.633 Adobe Shockwave Player 11.6.1.629 Adobe Shockwave Player 11.6.0.626 Adobe Shockwave Player 11.5.9.620 Adobe Shockwave Player 11.5.9.615 Adobe Shockwave Player 11.5.8.612 Adobe Shockwave Player 11.5.0.595 Adobe Shockwave Player 11.0.3.471 Adobe Shockwave Player 11.0.0.456 Adobe Shockwave Player 11 Adobe Shockwave Player 10.2.0.022 Adobe Shockwave Player 10.2.0.021 Adobe Shockwave Player 10.1.4.020 Adobe Shockwave Player 10.1.1.016 Adobe Shockwave Player 10.1.0.011 Adobe Shockwave Player 10.0.1.004 Adobe Shockwave Player 10.0.0.210 Adobe Shockwave Player 10
Not Vulnerable:	Adobe Shockwave Player 11.6.4.634

Adobe Shockwave Player CVE-2012-0758 DIR File Handling Remote Heap Overflow Vulnerability

Adobe Shockwave Player is prone to a remote heap-overflow vulnerability because of an integer-overflow error.

Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Versions prior to Adobe Shockwave Player 11.6.4.634 are vulnerable.

Adobe Shockwave Player CVE-2012-0758 DIR File Handling Remote Heap Overflow Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Adobe Shockwave Player CVE-2012-0758 DIR File Handling Remote Heap Overflow Vulnerability

Solution:
Updates are available. Please see the references for details.

Adobe Shockwave Player CVE-2012-0758 DIR File Handling Remote Heap Overflow Vulnerability

References:

• [CAL-2011-0071]Adobe Shockwave Player Parsing cupt atom heap overflow (Code Audit Labs of vulnhunt.com)
  
• Adobe Homepage (Adobe)
  
• APSB12-02 Security update available for Adobe Shockwave Player (Adobe)