Detections
Analytics
Shockwave Player < 11.5.0.601 Multiple Vulnerabilities (APSB09-11)
high Nessus Plugin ID 40421
Synopsis
The remote Windows host contains an Internet Explorer plugin which uses a vulnerable version of the Microsoft Active Template Library (ATL).Description
The remote Windows host contains a version of Adobe's Shockwave Player that is earlier than 11.5.0.601. Such versions were compiled against a version of Microsoft's Active Template Library (ATL) that contained a vulnerability. If an attacker can trick a user of the affected software into opening such a file, this issue could be leveraged to execute arbitrary code with the privileges of that user.Solution
Uninstall the Internet Explorer version of Shockwave Player version 11.5.0.600 and earlier, restart the system, and then install version 11.5.0.601 or later.See Also
http://blogs.adobe.com/psirt/2009/07/impact_of_microsoft_atl_vulner.html/
https://www.adobe.com/support/security/bulletins/apsb09-11.html
Plugin Details
Severity: High
ID: 40421
File Name: shockwave_player_apsb09_11.nasl
Version: 1.17
Type: local
Agent: windows
Family: Windows
Published: 7/29/2009
Updated: 11/15/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:adobe:shockwave_player
Required KB Items: SMB/Registry/Enumerated
Exploit Ease: No known exploits are available
Patch Publication Date: 7/29/2009
Vulnerability Publication Date: 7/28/2009
Reference Information
CVE: CVE-2009-0901, CVE-2009-2493, CVE-2009-2495
BID: 35845