BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to the Zeroday Tracker: Your Vulnerability Watchlist

Get critical updates on the latest zeroday threats, including impact, mitigation and protection information - only from BeyondTrust.

Adobe Shockwave Settings Remote Code Execution

Disclosed November 3, 2010    Fully Patched

Vulnerability Description:

Adobe Shockwave Player contains a vulnerability that is caused by misallocated memory in a compatibility component of the player. Successful exploitation of the vulnerability requires tricking the user into opening the Shockwave Settings window when viewing a malicious webpage with Shockwave content. After the user has been tricked, the attacker may remotely execute code in the context of the user.

Vendors:

Adobe

Vulnerable Software/Devices:

Adobe Shockwave Player 11.x

Vulnerability Severity:

Low

Exploit Availability:

N/A

Exploit Impact:

Remote Code Execution
Remote Code Execution under current user's privileges. This client-side issue may be exploited by an attacker by tricking a user to open the Settings window within the Shockwave player while the user is on a website with malicious Shockwave content. Once the user is tricked, the attacker may remotely execute code and possibly gain complete control of the target machine.

BeyondTrust Prevention and Detection:

  • BeyondTrust's Retina® Network Security Scanner scans devices to detect for this vulnerability.
    • Retina Audit 13711 - Adobe Shockwave Player Settings Window (Zero-Day) - Windows
    • Retina Audit 13712 - Adobe Shockwave Player Settings Window (Zero-Day) - Mac OS X

Mitigation:

Do not open the Shockwave Settings window while viewing Shockwave content.

Links:

CVE(s):

None

Leave a Reply