CERT-In Advisory
CIAD-2010-0068
Adobe Shockwave Player Multiple Vulnerabilities
Original Issue Date: November 08, 2010
Severity Rating: High
Systems Affected
- Adobe Shockwave Player version 11.5.8.612 and prior (Windows and Macintosh)
Overview
Multiple vulnerabilities have been reported in Adobe Shockwave Player, which could allow a remote attacker to execute arbitrary code or cause denial of service condition.
Description
1. "pamm" Chunk Parsing Memory corruption Vulnerability
(
CVE-2010-2581
)
This vulnerability is caused due to improper validation of the size and number of sub-chunks inside a "pamm" chunk in a director file during initial parsing of the sub-chunks in dirapi.dll. This can be exploited to corrupt memory outside the bounds of a buffer allocated for the "pamm" data via a specially crafted Director file.
Successful exploitation of this vulnerability could allow attacker to execute arbitrary code or cause denial of service condition.
2. "DEMX" Chunk Parsing Heap-based buffer overflow Vulnerability
(
CVE-2010-2582
)
This vulnerability is caused due to improper reallocation of a buffer when processing a DEMX chunk in a Director file in TextXtra.x32 when parsing "DEMX" chunks. This can be exploited to cause a heap-based buffer overflow via a specially crafted Director file. Successful exploitation of this vulnerability could allow attacker to execute arbitrary code.
3. 'dirapi.dll' Stack Overflow Vulnerability
(
CVE-2010-3655
)
This vulnerability is caused due to an error in dirapi.dll when parsing strings with a one-byte size prefix of 0xFF inside "Lnam" chunks. A remote attacker could exploit this vulnerability via a specially crafted "Lnam chunks" to trigger a stack-based buffer overflow error. Successful exploitation of this vulnerability could allow attacker to execute arbitrary code.
This vulnerability is exists within code responsible for parsing Director files (.dir). When handling the 3D record type 0xFFFFFF89. The module trusts size fields within a substructure and can be forced to make a faulty memory allocation.
4. 'dirapi.dll' multiple memory corruption vulnerabilities
(
CVE-2010-4084
CVE-2010-4085
CVE-2010-4086
CVE-2010-4088
)
Multiple memory corruption vulnerabilities have been reported in 'dirapi.dll' in Adobe Shockwave player due to various parsing errors. A remote attacker could exploit these vulnerabilities via a specially crafted Director (.dir) media file with an invalid element size to trigger memory corruption error. Successful exploitation of this vulnerability could allow attacker to execute arbitrary code.
5. "IML32.dll" Stack Overflow Vulnerability
(
CVE-2010-4087
CVE-2010-4089
)
This vulnerability is caused due to an error in IML32.dll when parsing "VSWV" entries with invalid lengths inside "pamm" chunks. A remote attacker could exploit this vulnerability via a specially crafted .dir file with a mmap record containing an invalid length of a VSWV entry to trigger memory corruption error. Successful exploitation of this vulnerability could allow attacker to execute arbitrary code or cause denial of service condition.
6. 'SetVertexArray()' Remote Code execution Vulnerability
(
CVE-2010-4090
)
This vulnerability is caused due to improper validation of certain size fields within a substructure when handling 3D records of type 0xFFFFFF89 in Director files (.dir). A remote attacker could exploit this vulnerability via a specially crafted Director (.dir) to trigger memory corruption error. Successful exploitation of this vulnerability could allow attacker to execute arbitrary code in the context of currently logged-in user.
Solution
Upgrade to Adobe Shockwave Player version 11.5.9.615:
http://get.adobe.com/shockwave/
Vendor Information
Adobe
http://www.adobe.com/support/security/advisories/apsa10-04.html
http://www.adobe.com/support/security/bulletins/apsb10-25.html
References
Adobe
http://www.adobe.com/support/security/bulletins/apsb10-25.html
ZDI
http://www.zerodayinitiative.com/advisories/ZDI-10-227/
http://www.zerodayinitiative.com/advisories/ZDI-10-228/
Check Point
http://archives.neohapsis.com/archives/fulldisclosure/2010-10/0492.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-10/0495.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-10/0494.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-10/0496.html
SecurityFocus
http://www.securityfocus.com/bid/44512
http://www.securityfocus.com/bid/44513
http://www.securityfocus.com/bid/44514
http://www.securityfocus.com/bid/44515
http://www.securityfocus.com/bid/44516
http://www.securityfocus.com/bid/44517
http://www.securityfocus.com/bid/44518
http://www.securityfocus.com/bid/44519
http://www.securityfocus.com/bid/44520
http://www.securityfocus.com/bid/44521
Vupen
http://www.vupen.com/english/advisories/2010/2826
Secunia
http://secunia.com/advisories/41932
http://secunia.com/secunia_research/2010-113/
http://secunia.com/secunia_research/2010-114/
CVE Name
CVE-2010-2582
CVE-2010-3655
CVE-2010-4084
CVE-2010-4085
CVE-2010-2581
CVE-2010-4086
CVE-2010-4087
CVE-2010-4088
CVE-2010-4089
CVE-2010-4090
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|