Vulnerability Name:

CVE-2009-3465 (CCN-54120)

Assigned:2009-11-03
Published:2009-11-03
Updated:2017-09-19
Summary:Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via crafted Shockwave content on a web site, related to an "invalid pointer vulnerability," a different issue than CVE-2009-3464.
Note: some of these details are obtained from third party information.
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-94
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2009-3465

Source: CCN
Type: SA37214
Adobe Shockwave Player Multiple Vulnerabilities

Source: CCN
Type: SECTRACK ID: 1023123
Shockwave Invalid Index and Pointer Flaws Let Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1023123

Source: CCN
Type: Adobe Product Security Bulletin APSB09-16
Security updates available for Shockwave Player

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.adobe.com/support/security/bulletins/apsb09-16.html

Source: BID
Type: UNKNOWN
36905

Source: CCN
Type: BID-36905
Adobe Shockwave Player Multiple Remote Code Execution and Denial of Service Vulnerabilities

Source: VUPEN
Type: Patch, Vendor Advisory
ADV-2009-3134

Source: XF
Type: UNKNOWN
shockwave-invalid-pointer-code-execution(54120)

Source: XF
Type: UNKNOWN
shockwave-invalid-pointer-code-execution(54120)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:5722

Vulnerable Configuration:Configuration 1:
  • cpe:/a:adobe:shockwave_player:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:shockwave_player:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:shockwave_player:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:shockwave_player:4.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:shockwave_player:5.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:shockwave_player:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:shockwave_player:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:shockwave_player:8.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:shockwave_player:9:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:shockwave_player:10.1.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:shockwave_player:11.0.0.456:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:shockwave_player:11.5.0.595:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:shockwave_player:11.5.0.596:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:shockwave_player:*:*:*:*:*:*:*:* (Version <= 11.5.1.601)

    • Configuration CCN 1:
  • cpe:/a:adobe:shockwave_player:11.5.1.601:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:5722
    V
    		Adobe Shockwave Player before 11.5.2.602 allows arbitrary Code Execution invalid pointer Vulnerability
    2014-11-10
    BACK
    adobe shockwave player 1.0
    adobe shockwave player 2.0
    adobe shockwave player 3.0
    adobe shockwave player 4.0
    adobe shockwave player 5.0
    adobe shockwave player 6.0
    adobe shockwave player 8.0
    adobe shockwave player 8.5.1
    adobe shockwave player 9
    adobe shockwave player 10.1.0.11
    adobe shockwave player 11.0.0.456
    adobe shockwave player 11.5.0.595
    adobe shockwave player 11.5.0.596
    adobe shockwave player *
    adobe shockwave player 11.5.1.601