The implementation of pami RIFF chunk parsing in Adobe Shockwave Player before 11.5.7.609 does not validate a certain value from a file before using it in file-pointer calculations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file.

The remote Mac OS X host contains a version of Adobe Shockwave Player that is 11.5.6.606 or earlier. It is, therefore, affected by multiple vulnerabilities :

  - Processing specially crafted FFFFFF45h Shockwave     3D blocks results in memory corruption. (CVE-2010-0127,     CVE-2010-1283)

  - A signedness error leads to memory corruption when     processing specially crafted Director files.
    (CVE-2010-0128)

  - An array indexing error leads to memory corruption when     processing specially crafted Director files.
    (CVE-2010-0129)

  - An integer overflow vulnerability leads to memory     corruption when processing specially crafted Director     files. (CVE-2010-0130)

  - An unspecified error when processing asset entries     in Director files leads to memory corruption.
    (CVE-2010-0986)

  - A boundary error when processing embedded fonts from a     Directory file leads to memory corruption.
    (CVE-2010-0987)

  - An unspecified error when processing Director files     results in memory corruption. (CVE-2010-1280)

  - Several unspecified memory corruption vulnerabilities.
    (CVE-2010-1281, CVE-2010-1282, CVE-2010-1284,     CVE-2010-1286, CVE-2010-1287, CVE-2010-1288,     CVE-2010-1289, CVE-2010-1290, CVE-2010-1291,     CVE-2010-1292)

The remote Windows host contains a version of Adobe's Shockwave Player that is earlier than 11.5.7.609.  Such versions are affected by the following issues :

  - Processing specially crafted FFFFFF45h Shockwave     3D blocks can result in memory corruption.
    (CVE-2010-0127, CVE-2010-1283)

  - A signedness error that can lead to memory corruption     when processing specially crafted Director files.
    (CVE-2010-0128)

  - An array indexing error that can lead to memory     corruption when processing specially crafted     Director files. (CVE-2010-0129)

  - An integer overflow vulnerability that can lead to     memory corruption when processing specially     crafted Director files. (CVE-2010-0130)

  - An unspecified error when processing asset entries     in Director files can lead to memory corruption.
    (CVE-2010-0986)

  - A boundary error when processing embedded fonts     from a Directory file can lead to memory corruption.
    (CVE-2010-0987)

  - An unspecified error when processing Director files     can result in memory corruption. (CVE-2010-1280)

  - Several unspecified memory corruption vulnerabilities.
    (CVE-2010-1281, CVE-2010-1282, CVE-2010-1284,     CVE-2010-1286, CVE-2010-1287, CVE-2010-1288,     CVE-2010-1289, CVE-2010-1290, CVE-2010-1291,     CVE-2010-1292)

ID	Name	Product	Family	Severity
80172	Adobe Shockwave Player <= 11.5.6.606 Multiple Vulnerabilities (APSB10-12) (Mac OS X)	Nessus	MacOS X Local Security Checks	high
46329	Shockwave Player < 11.5.7.609 Multiple Vulnerabilities (APSB10-12)	Nessus	Windows	high

Detections

Analytics

CVE-2010-1292

high

Tenable Plugins

high

high