exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Adobe Shockwave Player Memory Corruption

Adobe Shockwave Player Memory Corruption
Posted Nov 9, 2011
Authored by Code Audit Labs | Site vulnhunt.com

Code Audit Labs has discovered that Adobe Shockwave Player suffers from a director file PAMM memory corruption vulnerability.

tags | advisory
advisories | CVE-2011-2446
SHA-256 | 8fa0331e11caebc74f418fca888a60b9a5de00d45ee773bf9557006f4fd13e66

Adobe Shockwave Player Memory Corruption

Change Mirror Download
[CAL-2011-0052]Adobe Shockwave Player Director File Parsing PAMM memory
corruption vulnerability



CAL ID: CAL-2011-0052
CVE ID: CVE-2011-2446
Discover: instruder of code audit labs of vulnhunt.com
http://www.adobe.com/support/security/bulletins/apsb11-27.html


1 Affected Products
=================
Test Version£ÂșAdobe Shockwave Player 11.6.1.629(last)


2 Vulnerability Details
=====================
instruder of code audit labs of vulnhunt.com have discovered a
vulnerability in
Adobe Shockwave Player.when adobe shockwave player parsing header of
Director
File, although the field of block_count of PAMM atom haved done
strictly limited,
but you can bypass the limit with other fields.Thus in the
cycle,leading to a wrong address to write to cause Memory corruption.


3 Exploitable?
============
This vulnerability will lead to memory corruption ,Successful exploition
may cause code execution .



4 Crash info:
===============
(308.9d0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=07dd1ff4 ebx=7ffffffb ecx=00007f1f edx=000b8e5c esi=07ed3d48
edi=000093eb
eip=07052920 esp=0227dc9c ebp=00000000 iopl=0 nv up ei ng nz ac
po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010292
*** ERROR: Module load completed but symbols could not be loaded for
C:\WINDOWS\system32\Adobe\Shockwave 11\DIRAPI.dll
DIRAPI+0x2920:
07052920 6621480c and word ptr [eax+0Ch],cx
ds:0023:07dd2000=????
0:005> kb
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be
wrong.
00000000 00000000 00000000 00000000 00000000 DIRAPI+0x2920


5 Timeline
=========
2011-9-16 report to adobe
2011-9-17 vendor ask poc file
2011-9-17 we sent the poc file.
2011-9-20 vendor comfirm the issue.
2011-11-8 Coordinated public release of advisory.


6 About Code Audit Labs:
=====================
Code Audit Labs secure your software,provide Professional include source
code audit and binary code audit service.
Code Audit Labs:" You create value for customer,We protect your value"
http://www.VulnHunt.com

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close