9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.922 High
EPSS
Percentile
99.0%
Added: 11/04/2010
CVE: CVE-2010-3653
BID: 44291
OSVDB: 68803
Adobe Shockwave is a multimedia player used to add animation and interactivity to web pages. It allows Adobe Director applications to be published on the Internet and viewed in a web browser on any computer which has the Shockwave plug-in installed.
A code execution vulnerability exists in Adobe Shockwave. The vulnerability is due to an error in **DIRAPI.dll**
while parsing a value from a **rcsL**
Resource Interchange File Format (RIFF) chunk record. This value is used without validation to perform operations on heap memory. A remote attacker can exploit this vulnerability by enticing a user to open a malicious file. This could result in arbitrary remote code execution in the security context of the logged in user.
Upgrade to the newest version of Adobe Shockwave Player as described in Security Bulletin APSB10-25.
<http://secunia.com/advisories/41932>
Exploit works on Adobe Systems Shockwave Player 11.5.8.612.
The user must open the exploit page in Internet Explorer 6 or 7.
Windows