Signature Detail

HTTP: Adobe Shockwave Director tSAC Chunk Parsing Memory Corruption

This signature detects attempts to exploit a known code execution vulnerability in Adobe Shockwave player. It is due to a signedness error while parsing tSAC chunks in Adobe Director files. By providing a certain negative value, calculation of a pointer can lead to a memory corruption. Remote attackers can exploit this by enticing target users to open a malicious DIR file using a vulnerable version of the product. A successful attack can result in arbitrary code execution in the security context of the logged in user. In an unsuccessful attack, the affected application can terminate abnormally.

Extended Description

Adobe Shockwave Player is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed attacks may cause a denial-of-service condition. Adobe Shockwave Player 11.5.7.609 and prior are vulnerable. NOTE: This issue was previously covered in BID 42657 (Adobe Shockwave Player APSB10-20 Multiple Remote Vulnerabilities) but has been given its own record to better document it.

Affected Products

• Adobe Shockwave Player 11.5.0.596
• Adobe Shockwave Player 11.5.0.600
• Adobe Shockwave Player 11.5.0.601
• Adobe Shockwave Player 11.5.1.601
• Adobe Shockwave Player 11.5.2.602
• Adobe Shockwave Player 11.5.2.606
• Adobe Shockwave Player 11.5.6.606
• Adobe Shockwave Player 11.5.7.609

References

• BugTraq: 42665
• CVE: CVE-2010-2866