CVE-2010-1283

Related Files

Adobe Shockwave 0xFFFFFF49 3D Block Code Execution Vulnerability

Posted May 14, 2010

Authored by Chaouki Bekrar | Site vupen.com

VUPEN Vulnerability Research Team discovered a critical vulnerability in Adobe Shockwave Player. This vulnerability is caused due to a memory corruption error when processing 0xFFFFFF49 3D blocks within Director files, which could be exploited by attackers to execute arbitrary code by tricking a user into visiting a specially crafted web page. Versions prior to 11.5.7.609 are affected.

tags | advisory, web, arbitrary

advisories | CVE-2010-1283

SHA-256 | fca3c4b1182174601636ba9081feb0d22ccfa325385cdaa1d84cce75cdd4a5ee

Download | Favorite | View

Zero Day Initiative Advisory 10-088

Posted May 12, 2010

Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 10-088 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Shockwave. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists within the code responsible for parsing 3D objects defined inside Director files. An undocumented 4-byte field within record type 0xFFFFFF49 can be modified to cause corruption of heap memory. This corruption can be used to modify function pointers and achieve code execution.

tags | advisory, remote, arbitrary, code execution

advisories | CVE-2010-1283

SHA-256 | 5e8e6aca52cd9ed7563236913285f6f64f77388220a08ca6e191ad9106f6dc26

Download | Favorite | View