lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <4EB9ECF2.3040008@gmail.com> Date: Wed, 09 Nov 2011 11:01:06 +0800 From: Code Audit Labs <vulnhunt@...il.com> To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com Subject: [CAL-2011-0052]Adobe Shockwave Player Director File Parsing PAMM memory corruption vulnerability [CAL-2011-0052]Adobe Shockwave Player Director File Parsing PAMM memory corruption vulnerability CAL ID: CAL-2011-0052 CVE ID: CVE-2011-2446 Discover: instruder of code audit labs of vulnhunt.com http://www.adobe.com/support/security/bulletins/apsb11-27.html 1 Affected Products ================= Test Version:Adobe Shockwave Player 11.6.1.629(last) 2 Vulnerability Details ===================== instruder of code audit labs of vulnhunt.com have discovered a vulnerability in Adobe Shockwave Player.when adobe shockwave player parsing header of Director File, although the field of block_count of PAMM atom haved done strictly limited, but you can bypass the limit with other fields.Thus in the cycle,leading to a wrong address to write to cause Memory corruption. 3 Exploitable? ============ This vulnerability will lead to memory corruption ,Successful exploition may cause code execution . 4 Crash info: =============== (308.9d0): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=07dd1ff4 ebx=7ffffffb ecx=00007f1f edx=000b8e5c esi=07ed3d48 edi=000093eb eip=07052920 esp=0227dc9c ebp=00000000 iopl=0 nv up ei ng nz ac po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010292 *** ERROR: Module load completed but symbols could not be loaded for C:\WINDOWS\system32\Adobe\Shockwave 11\DIRAPI.dll DIRAPI+0x2920: 07052920 6621480c and word ptr [eax+0Ch],cx ds:0023:07dd2000=???? 0:005> kb ChildEBP RetAddr Args to Child WARNING: Stack unwind information not available. Following frames may be wrong. 00000000 00000000 00000000 00000000 00000000 DIRAPI+0x2920 5 Timeline ========= 2011-9-16 report to adobe 2011-9-17 vendor ask poc file 2011-9-17 we sent the poc file. 2011-9-20 vendor comfirm the issue. 2011-11-8 Coordinated public release of advisory. 6 About Code Audit Labs: ===================== Code Audit Labs secure your software,provide Professional include source code audit and binary code audit service. Code Audit Labs:" You create value for customer,We protect your value" http://www.VulnHunt.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists