Adobe Shockwave Player <= 12.2.7.197 DLL Hijacking (APSB17-08)

This script is Copyright (C) 2017 Tenable Network Security, Inc.


Synopsis :

The remote Windows host contains a web browser plugin that is affected
by a DLL hijacking vulnerability.

Description :

The remote Windows host contains a version of Adobe Shockwave Player
that is prior or equal to 12.2.7.197. It is, therefore, affected by a
DLL hijacking vulnerability when loading certain dynamic link library
(DLL) files due to searching an insecure path that may not be trusted
or under user control. An unauthenticated, remote attacker can exploit
this issue to execute arbitrary code, with the privileges of the user
running the program, by placing a specially crafted file in the path
and convincing the user to open a supported file type (e.g., located
on a remote WebDAV share).

See also :

https://helpx.adobe.com/security/products/shockwave/apsb17-08.html

Solution :

Upgrade to Adobe Shockwave Player version 12.2.8.198 or later.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.7
(CVSS2#E:F/RL:OF/RC:ND)
Public Exploit Available : true

Family: Windows

Nessus Plugin ID: 97835 ()

Bugtraq ID: 96863

CVE ID: CVE-2017-2983

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now