Vulnerability CVE-2010-4196 - CERT Civis.Net

Vulnerability Name:

CVE-2010-4196 (CCN-65256)

Assigned:

2010-11-05

Published:

2011-02-08

Updated:

2011-02-17

Summary:

The Shockwave 3d Asset module in Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data, which allows attackers to execute arbitrary code via unknown vectors.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2010-4196

Source: CCN
Type: Adobe Product Security Bulletin APSB11-01
Security update available for Shockwave Player

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.adobe.com/support/security/bulletins/apsb11-01.html

Source: CCN
Type: US-CERT VU#189929
Adobe Shockwave 11.5.9.615 contains multiple memory corruption vulnerabilities

Source: CERT-VN
Type: US Government Resource
VU#189929

Source: CCN
Type: OSVDB ID: 72999
Adobe Shockwave Player 3d Asset Module Input Validation Unspecified Arbitrary Code Execution

Source: BID
Type: UNKNOWN
46338

Source: CCN
Type: BID-46338
Adobe Shockwave Player 3D Assets Module Input Validation Remote Code Execution Vulnerability

Source: SECTRACK
Type: UNKNOWN
1025056

Source: VUPEN
Type: Vendor Advisory
ADV-2011-0335

Source: XF
Type: UNKNOWN
shockwave-3dasset-code-execution(65256)

Vulnerable Configuration:

Configuration 1:

cpe:/a:adobe:shockwave_player:1.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:2.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:3.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:4.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:5.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:6.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:8.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:8.0.196:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:8.0.196a:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:8.0.204:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:8.0.205:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:8.5.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:8.5.1.100:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:8.5.1.103:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:8.5.1.105:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:8.5.1.106:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:8.5.321:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:8.5.323:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:8.5.324:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:8.5.325:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:9:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:9.0.383:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:9.0.432:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:10.0.0.210:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:10.0.1.004:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:10.1.0.011:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:10.1.0.11:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:10.1.1.016:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:10.1.4.020:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:10.2.0.021:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:10.2.0.022:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:10.2.0.023:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:11.0.0.456:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:11.0.3.471:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:11.5.0.595:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:11.5.0.596:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:11.5.1.601:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:11.5.2.602:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:11.5.6.606:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:11.5.7.609:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:11.5.8.612:*:*:*:*:*:*:*

OR cpe:/a:adobe:shockwave_player:*:*:*:*:*:*:*:* (Version <= 11.5.9.615)

Configuration CCN 1:

cpe:/a:adobe:shockwave_player:11.5.9.615:*:*:*:*:*:*:*

Denotes that component is vulnerable