Shockwave Player < 11.6.0.626 (APSB11-17)

High Nessus Plugin ID 55142

Synopsis

The remote Windows host contains a web browser plugin that is affected by multiple vulnerabilities.

Description

The remote Windows host contains a version of Adobe's Shockwave Player that is earlier than 11.6.0.626. Such versions are potentially affected by the following issues :

- Multiple memory corruption vulnerabilities affect the 'Dirapi.dll' component that can result in arbitrary code execution. (CVE-2011-0317, CVE-2011-0318, CVE-2011-0319, CVE-2011-0320, CVE-2011-2119, CVE-2011-0335, CVE-2011-2122)

- An arbitrary code execution vulnerability occurs due to an unspecified design flaw. (CVE-2011-2108)

- Multiple integer overflow vulnerabilities affect the 'Dirapi.dll' component that can result in arbitrary code execution. (CVE-2011-2109)

- Multiple memory corruption vulnerabilities affect the 'IML32.dll' component that can result in arbitrary code execution. (CVE-2011-2111, CVE-2011-2115, CVE-2011-2116)

- Multiple buffer overflow vulnerabilities affect the 'IML32.dll' component that can result in arbitrary code execution. (CVE-2011-2112)

- Multiple buffer overflow vulnerabilities affect the 'Shockwave3DAsset' component that can result in arbitrary code execution. (CVE-2011-2113)

- Multiple unspecified memory corruption vulnerabilities can result in arbitrary code execution. (CVE-2011-2114, CVE-2011-2117, CVE-2011-2124, CVE-2011-2127, CVE-2011-2128)

- An input validation vulnerability affects the 'FLV ASSET Xtra' component that can result in arbitrary code execution. (CVE-2011-2118)

- An integer overflow vulnerability affects the 'CursorAsset x32' component that can result in arbitrary code execution. (CVE-2011-2120)

- An unspecified integer overflow vulnerability can result in arbitrary code execution. (CVE-2011-2121)

- An integer overflow vulnerability affects the 'Shockwave 3D Asset x32' component that can result in arbitrary code execution. (CVE-2011-2123)

- A buffer overflow vulnerability affects the 'Dirapix.dll' component that can result in arbitrary code execution. (CVE-2011-2125)

- An unspecified buffer overflow vulnerability can result in arbitrary code execution. (CVE-2011-2126)

Solution

Upgrade to Adobe Shockwave 11.6.0.626 or later.

See Also

http://www.zerodayinitiative.com/advisories/ZDI-11-200/

http://www.zerodayinitiative.com/advisories/ZDI-11-201/

http://www.zerodayinitiative.com/advisories/ZDI-11-202/

http://www.zerodayinitiative.com/advisories/ZDI-11-203/

http://www.zerodayinitiative.com/advisories/ZDI-11-204/

http://www.zerodayinitiative.com/advisories/ZDI-11-205/

http://www.zerodayinitiative.com/advisories/ZDI-11-206/

http://www.zerodayinitiative.com/advisories/ZDI-11-207/

http://www.zerodayinitiative.com/advisories/ZDI-11-208/

http://www.zerodayinitiative.com/advisories/ZDI-11-209/

http://www.zerodayinitiative.com/advisories/ZDI-11-210/

http://www.zerodayinitiative.com/advisories/ZDI-11-211/

http://www.zerodayinitiative.com/advisories/ZDI-11-212/

http://www.zerodayinitiative.com/advisories/ZDI-11-213/

http://www.zerodayinitiative.com/advisories/ZDI-11-214/

http://www.zerodayinitiative.com/advisories/ZDI-11-215/

http://www.zerodayinitiative.com/advisories/ZDI-11-216/

http://www.zerodayinitiative.com/advisories/ZDI-11-217/

http://www.zerodayinitiative.com/advisories/ZDI-12-041/

http://www.adobe.com/support/security/bulletins/apsb11-17.html

Plugin Details

Severity: High

ID: 55142

File Name: shockwave_player_apsb11-17.nasl

Version: 1.9

Type: local

Agent: windows

Family: Windows

Published: 2011/06/15

Modified: 2018/07/27

Dependencies: 39564

Risk Information

Risk Factor: High

CVSSv2

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:adobe:shockwave_player

Required KB Items: SMB/shockwave_player

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2011/06/14

Vulnerability Publication Date: 2011/06/14

Reference Information

CVE: CVE-2011-0317, CVE-2011-0318, CVE-2011-0319, CVE-2011-0320, CVE-2011-0335, CVE-2011-2108, CVE-2011-2109, CVE-2011-2111, CVE-2011-2112, CVE-2011-2113, CVE-2011-2114, CVE-2011-2115, CVE-2011-2116, CVE-2011-2117, CVE-2011-2118, CVE-2011-2119, CVE-2011-2120, CVE-2011-2121, CVE-2011-2122, CVE-2011-2124, CVE-2011-2125, CVE-2011-2126, CVE-2011-2127, CVE-2011-2128

BID: 48273, 48275, 48278, 48284, 48286, 48287, 48288, 48289, 48290, 48291, 48292, 48294, 48296, 48297, 48298, 48299, 48300, 48302, 48304, 48306, 48307, 48308, 48309, 48310, 48311