exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Adobe Shockwave Director mmap Trusted Chunk Size Remote Code Execution

Adobe Shockwave Director mmap Trusted Chunk Size Remote Code Execution
Posted Aug 26, 2010
Authored by Aaron Portnoy, Logan Brown | Site dvlabs.tippingpoint.com

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Shockwave. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the DIRAPIX module responsible for parsing the RIFF-based Director file format. When handling the mmap chunk, the process trusts the chunk size immediately following the fourCC value. It is passed to Ordinal1111 exported by the IML32X module which is responsible for allocating a heap buffer for processing the rest of the chunk. If an incorrect size is provided, later memory copies can corrupt data beyond the allocated buffer. This can be abused to execute remote code under the context of the user running the web browser.

tags | advisory, remote, web, arbitrary
advisories | CVE-2010-2870
SHA-256 | 81e8ba67b1a1a3b42dc58319b1e12d7d52164ce3c75ee9898b373eeafb8c25bb

Adobe Shockwave Director mmap Trusted Chunk Size Remote Code Execution

Change Mirror Download
TPTI-10-15: Adobe Shockwave Director mmap Trusted Chunk Size Remote Code Execution Vulnerability
http://dvlabs.tippingpoint.com/advisory/TPTI-10-15
August 24, 2010

-- CVE ID:
CVE-2010-2870

-- Affected Vendors:
Adobe

-- Affected Products:
Adobe Shockwave Player

-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of Adobe Shockwave. User interaction is
required to exploit this vulnerability in that the target must visit a
malicious page or open a malicious file.

The specific flaw exists within the DIRAPIX module responsible for
parsing the RIFF-based Director file format. When handling the mmap
chunk, the process trusts the chunk size immediately following the
fourCC value. It is passed to Ordinal1111 exported by the IML32X module
which is responsible for allocating a heap buffer for processing the
rest of the chunk. If an incorrect size is provided, later memory copies
can corrupt data beyond the allocated buffer. This can be abused to
execute remote code under the context of the user running the web
browser.

-- Vendor Response:
Adobe has issued an update to correct this vulnerability. More
details can be found at:

http://www.adobe.com/support/security/bulletins/apsb10-20.html

-- Disclosure Timeline:
2010-05-27 - Vulnerability reported to vendor
2010-08-24 - Coordinated public release of advisory

-- Credit:
This vulnerability was discovered by:
* TippingPoint FuzzBox as driven by Aaron Portnoy and Logan Brown
Login or Register to add favorites

File Archive:

November 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    1 Files
  • 2
    Nov 2nd
    0 Files
  • 3
    Nov 3rd
    0 Files
  • 4
    Nov 4th
    0 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    0 Files
  • 8
    Nov 8th
    0 Files
  • 9
    Nov 9th
    0 Files
  • 10
    Nov 10th
    0 Files
  • 11
    Nov 11th
    0 Files
  • 12
    Nov 12th
    0 Files
  • 13
    Nov 13th
    219 Files
  • 14
    Nov 14th
    19 Files
  • 15
    Nov 15th
    66 Files
  • 16
    Nov 16th
    38 Files
  • 17
    Nov 17th
    9 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    13 Files
  • 21
    Nov 21st
    11 Files
  • 22
    Nov 22nd
    56 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    36 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    14 Files
  • 28
    Nov 28th
    30 Files
  • 29
    Nov 29th
    35 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close