Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:24593
HistoryAug 26, 2010 - 12:00 a.m.

Adobe Shockwave Player Memory Corruption Vulnerability - CVE-2010-2881

2010-08-2600:00:00
vulners.com
20

I'm writing on behalf of the Check Point Vulnerability Discovery Team to publish the following vulnerability.

Check Point Software Technologies - Vulnerability Discovery Team (VDT)
http://www.checkpoint.com/defense/

Memory corruption when Adobe Shockwave Player parses .dir media file
CVE-2010-2881

INTRODUCTION

Adobe Shockwave Player is the Adobe plugin to many different browsers to view rich-media content on the web including animations, interactive presentations, and online entertainment.

Adobe Shockwave player does not properly parse .dir media file, which causes a corruption in module IML32.dll by opening a malformed file with an invalid value located in PoC repro02.dir at offset 0x24C0.

This problem was confirmed in the following versions of Adobe Shockwave Player, other versions may be also affected.

Shockwave Player version 11.5.7.609 and older for Windows and MacOS

CVSS Scoring System

The CVSS score is: 9
Base Score: 10
Temporal Score: 9
We used the following values to calculate the scores:
Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal score is: E:POC/RL:U/RC:C

TRIGGERING THE PROBLEM

To trigger the problem a PoC file (repro02.dir) is available to interested parts, together with a deep exploitability analysis.

DETAILS

Disassembly:

6900725F 8B0D 3CEA0B69 MOV ECX,DWORD PTR DS:[690BEA3C]
69007265 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
69007268 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C]
6900726B F7C7 07000000 TEST EDI,7
69007271 74 0F JE SHORT IML32.69007282
69007273 8A06 MOV AL,BYTE PTR DS:[ESI]
69007275 83C6 01 ADD ESI,1
69007278 8807 MOV BYTE PTR DS:[EDI],AL
6900727A 83C7 01 ADD EDI,1
6900727D 49 DEC ECX
6900727E 74 42 JE SHORT IML32.690072C2
69007280 ^EB E9 JMP SHORT IML32.6900726B
69007282 83F9 20 CMP ECX,20
69007285 7C 29 JL SHORT IML32.690072B0
69007287 0F6F5E 18 MOVQ MM3,QWORD PTR DS:[ESI+18] <— Problem

ESI = 0x06CAFFE8

CREDITS

This vulnerability was discovered and researched by Rodrigo Rubira Branco from Check Point Vulnerability Discovery Team (VDT).

Best Regards,

Rodrigo.


Rodrigo Rubira Branco
Senior Security Researcher
Vulnerability Discovery Team (VDT)
Check Point Software Technologies