Adobe Shockwave Player Heap Memory Indexing Vulnerability
2 Jul. 2010
Summary
Remote exploitation of a heap memory indexing vulnerability in Adobe Systems Inc.'s Shockwave Player could allow an attacker to execute arbitrary code with the privileges of the current user.
Vulnerable Systems:
* Shockwave Player version 11.5.6r606 for Windows
* Shockwave Player version 11.5.6r606 for Macintosh
* Shockwave Player version 11.5.6.606 for Windows
* Shockwave Player version 11.5.6.606 for Macintosh
The vulnerability takes place during the processing of a certain malformed file. A function calculates an offset to be used within a memory mapped file and returns the offset value. The return value is not checked. This can lead to a condition where an attacker is able to overwrite memory outside the bounds of the allocated memory map.
Exploitation of this vulnerability results in the execution of arbitrary code with the privileges of the user viewing the Web page. To exploit this vulnerability, a targeted user must load a malicious file created by an attacker. An attacker typically accomplishes this via social engineering or injecting content into a compromised, trusted site.
Adobe Shockwave Player implements a custom memory management system for object allocation. Due to the design of the memory allocator, an attacker is able to predict the distance of objects within a memory map. This condition can help facilitate reliable exploitation of this vulnerability.
Patch Availability:
Adobe has released a fix which addresses this issue. Information about downloadable vendor updates can be found by clicking on the URLs shown: http://get.adobe.com/shockwave/
Workaround:
The killbit for the Shockwave Player ActiveX control can be set by creating the following registry key:
Under this key create a new DWORD value called "Compatibility Flags" and set its hexadecimal value to 400.
To re-enable Shockwave Player set the "Compatibility Flags" value to 0.
