64646 : Adobe Shockwave Player Crafted DIR File Dereference Memory Corruption
Printer | http://osvdb.org/64646 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
3	629	about 1 year ago	about 1 year ago	19 times	80%

Timeline

Discovery Date	Vendor Informed Date	Vendor Ack Date	Disclosure Date	Exploit Publish Date	Vendor Solution Date
2009-09-19	2010-02-24	2010-02-24	2010-05-11	2010-05-11	2010-05-11

Time to Patch	Time to Exploit
76 days	234 days

Keywords

APSB10-12, ZSL-2010-4937, CAL-20100204-3

Description

Shockwave Player is prone to a memory corruption flaw. The application fails to properly sanitize user-supplied input resulting in a memory dereference. With a specially crafted DIR file, a context-dependent attacker can potentially cause arbitrary code execution.

Classification

Attack Type: Denial of Service, Input Manipulation
Impact: Loss of Integrity, Loss of Availability
Solution: Upgrade
Disclosure: Vendor Verified

Technical

(f94.ae4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=20a0a0a0 ebx=207d004c ecx=00000400 edx=41414140 esi=00000000 edi=a80487d8
eip=68008bd6 esp=0012de4c ebp=00000400 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00050206
*** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Director 11\DIRAPI.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for DIRAPI.dll -
DIRAPI!Ordinal14+0x3b16:
68008bd6 2b4f04 sub ecx,dword ptr [edi+4] ds:0023:a80487dc=????????

-----------------------

EAX FFFFFFFF
ECX 41414141
EDX FFFFFFFF
EBX 00000018
ESP 0012F3B4
EBP 02793578
ESI 0012F3C4
EDI 02793578
EIP 69009F1F IML32.69009F1F

Solution

Upgrade to version 11.5.7.609 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Unknown or Incomplete

References

Exploit Database: 12578
CVE ID: 2010-1280 (see also: NVD)
Secunia Advisory ID: 38751
Bugtraq ID: 40081
ISS X-Force ID: 58447
VUPEN Advisory: ADV-2010-1128
Other Advisory URL: http://news.dreamings.org/?p=1050
http://securityreason.com/exploitalert/8249
http://securityvulns.ru/Xdocument830.html
http://www.0daynet.com/2010/0512/335.html
http://www.auscert.org.au/render.html?it=12789
http://www.qualys.com/research/alerts/view.php/2010-05-11-2
http://www.zeroscience.mk/codes/shockwave_mem.txt
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php
Packet Storm: http://packetstormsecurity.org/filedesc/ZSL-2010-4937.txt.html
Mail List Post: http://seclists.org/bugtraq/2010/May/101
http://seclists.org/fulldisclosure/2010/May/138
Security Tracker: http://securitytracke ......
Vendor Specific News/Changelog Entry: http://www.adobe.com/support/security/bulletins/apsb10-12.html

Tools & Filters

	46329

Credit

Gjoko Krstic - Zero Science Lab

CVSSv2 Score

CVSSv2 Base Score = 9.3
Source: nvd.nist.gov | Generated: 2010-05-14 | Disagree?

Blogs

This product uses the Daylife API but is not endorsed or certified by Daylife.

This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.

None found at this time

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.