// For flags

CVE-2010-2871

Adobe Shockwave Player Director File FFFFFF45 Record Processing Remote Code Execution Vulnerability

Severity Score

9.3
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Integer overflow in the 3D object functionality in Adobe Shockwave Player before 11.5.8.612 allows remote attackers to cause a denial of service (heap memory corruption) or execute arbitrary code via a crafted size value in a 0xFFFFFF45 RIFF record in a Director movie.

Desbordamiento de entero en la funcionalidad 3D en Adobe Shockwave Player anterior a 11.5.8.612, permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria dinámica -heap-) o la ejecución de código de su elección a través de un tamaño con un valor manipulado en un registro 0xFFFFFF45 RIFF en una película de Director.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the application's support for 3D objects. While parsing the 0xFFFFFF45 RIFF record type, the process performs arithmetic on a size value and uses the result for a heap-based allocation. By specifying a large enough value an attacker can force the integer to wrap and thus the process will under-allocate the buffer. This memory is later copied into using a different size value which results in object corruption that can be leveraged to execute arbitrary code under the context of the user running the browser.

*Credits: Anonymous
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2010-07-27 CVE Reserved
  • 2010-08-24 CVE Published
  • 2024-08-07 CVE Updated
  • 2024-10-13 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-189: Numeric Errors
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
<= 11.5.7.609
Search vendor "Adobe" for product "Shockwave Player" and version " <= 11.5.7.609"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
1.0
Search vendor "Adobe" for product "Shockwave Player" and version "1.0"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
2.0
Search vendor "Adobe" for product "Shockwave Player" and version "2.0"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
3.0
Search vendor "Adobe" for product "Shockwave Player" and version "3.0"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
4.0
Search vendor "Adobe" for product "Shockwave Player" and version "4.0"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
5.0
Search vendor "Adobe" for product "Shockwave Player" and version "5.0"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
6.0
Search vendor "Adobe" for product "Shockwave Player" and version "6.0"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.0
Search vendor "Adobe" for product "Shockwave Player" and version "8.0"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.0.196
Search vendor "Adobe" for product "Shockwave Player" and version "8.0.196"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.0.196a
Search vendor "Adobe" for product "Shockwave Player" and version "8.0.196a"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.0.204
Search vendor "Adobe" for product "Shockwave Player" and version "8.0.204"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.0.205
Search vendor "Adobe" for product "Shockwave Player" and version "8.0.205"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.1
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.1"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.1.100
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.1.100"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.1.103
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.1.103"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.1.105
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.1.105"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.1.106
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.1.106"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.321
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.321"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.323
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.323"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.324
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.324"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.325
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.325"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
9
Search vendor "Adobe" for product "Shockwave Player" and version "9"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
9.0.383
Search vendor "Adobe" for product "Shockwave Player" and version "9.0.383"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
9.0.432
Search vendor "Adobe" for product "Shockwave Player" and version "9.0.432"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.0.0.210
Search vendor "Adobe" for product "Shockwave Player" and version "10.0.0.210"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.0.1.004
Search vendor "Adobe" for product "Shockwave Player" and version "10.0.1.004"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.1.0.11
Search vendor "Adobe" for product "Shockwave Player" and version "10.1.0.11"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.1.0.011
Search vendor "Adobe" for product "Shockwave Player" and version "10.1.0.011"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.1.1.016
Search vendor "Adobe" for product "Shockwave Player" and version "10.1.1.016"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.1.4.020
Search vendor "Adobe" for product "Shockwave Player" and version "10.1.4.020"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.2.0.021
Search vendor "Adobe" for product "Shockwave Player" and version "10.2.0.021"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.2.0.022
Search vendor "Adobe" for product "Shockwave Player" and version "10.2.0.022"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.2.0.023
Search vendor "Adobe" for product "Shockwave Player" and version "10.2.0.023"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.0.0.456
Search vendor "Adobe" for product "Shockwave Player" and version "11.0.0.456"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.0.3.471
Search vendor "Adobe" for product "Shockwave Player" and version "11.0.3.471"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.5.0.595
Search vendor "Adobe" for product "Shockwave Player" and version "11.5.0.595"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.5.0.596
Search vendor "Adobe" for product "Shockwave Player" and version "11.5.0.596"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.5.1.601
Search vendor "Adobe" for product "Shockwave Player" and version "11.5.1.601"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.5.2.602
Search vendor "Adobe" for product "Shockwave Player" and version "11.5.2.602"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.5.6.606
Search vendor "Adobe" for product "Shockwave Player" and version "11.5.6.606"
-
Affected