HTTP: Adobe Shockwave Director rcsL Chunk Remote Code Execution

This signature detects attempts to exploit a known code execution vulnerability in Adobe Shockwave. It is due to an error while parsing a value from an rcsL RIFF chunk record. This value is used without validation to perform operations on heap memory. By crafting a special value, the file can be manipulated to corrupt a function pointer. A remote attacker can exploit this by enticing a user to process a malicious file. A successful attack can result in remote code execution in the security context of the logged in user.

Extended Description

Adobe Shockwave Player is prone to a memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed attacks may cause a denial-of-service condition. Adobe Shockwave Player 11.5.8.612 is vulnerable; other versions may also be affected.

Affected Products

Adobe shockwave_player

References

BugTraq: 44516 44291

CVE: CVE-2010-3655

URL: http://www.zerodayinitiative.com/advisories/zdi-10-227/

Short Name

HTTP:STC:ADOBE:XFIR-RCSL

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Adobe Shockwave Director rcsL Chunk Remote Code Execution

Extended Description

Affected Products

References

Found a potential security threat?