Update Plugs Critical Security Holes in Adobe Shockwave Player
Adobe announced that it uncovered several critical security vulnerabilities in Adobe Shockwave Player version 11.5.1.601 and previous versions. If successfully exploited by a person with malicious intent, these vulnerabilities could be used to run malicious code on the targeted machine. To prevent such an event from occurring the California-based company that specializes in creating multimedia and creativity software products has released Adobe Shockwave Player 11.5.2.602
“Critical vulnerabilities have been identified in Adobe Shockwave Player 11.5.1.601 and earlier versions. The vulnerabilities could allow an attacker, who successfully exploits the vulnerabilities, to run malicious code on the affected system. Adobe has provided a solution for the reported vulnerabilities. It is recommended that users update their installations using the instructions provided below. Adobe recommends Shockwave Player users install Shockwave Player version 11.5.2.602,” announced Adobe.
Here is a more in-depth look at the vulnerabilities the Adobe Shockwave Player 11.5.2.602 update fixes:
CVE-2009-3463
Invalid index vulnerability that could potentially lead to code execution
CVE-2009-3464, CVE-2009-3465
Invalid pointer vulnerabilities that could potentially lead to code execution
CVE-2009-3466
Invalid string length vulnerability that could potentially lead to code execution
CVE-2009-3244
Boundary condition issue that could lead to a Denial of Service (DoS) issue
Just to put things in perspective, Adobe uses a 4 tier security rating:
Low – the vulnerability is extremely hard to exploit; if exploited it has a minimal impact on the software and the user.
Moderate – the vulnerability is difficult to exploit; exploiting the vulnerability is directly related to certain factors (default configuration, auditing, etc).
Important – the vulnerability could compromise data security; the attacker could gain access to sensitive information or could compromise processing resources.
Critical – the vulnerability can be used to run malicious native-code without the user realizing anything wrong is happening.
If you would like to get Adobe Shockwave Player 11.5.2.602, a download location is available here.
“Critical vulnerabilities have been identified in Adobe Shockwave Player 11.5.1.601 and earlier versions. The vulnerabilities could allow an attacker, who successfully exploits the vulnerabilities, to run malicious code on the affected system. Adobe has provided a solution for the reported vulnerabilities. It is recommended that users update their installations using the instructions provided below. Adobe recommends Shockwave Player users install Shockwave Player version 11.5.2.602,” announced Adobe.
Here is a more in-depth look at the vulnerabilities the Adobe Shockwave Player 11.5.2.602 update fixes:
CVE-2009-3463
Invalid index vulnerability that could potentially lead to code execution
CVE-2009-3464, CVE-2009-3465
Invalid pointer vulnerabilities that could potentially lead to code execution
CVE-2009-3466
Invalid string length vulnerability that could potentially lead to code execution
CVE-2009-3244
Boundary condition issue that could lead to a Denial of Service (DoS) issue
Just to put things in perspective, Adobe uses a 4 tier security rating:
Low – the vulnerability is extremely hard to exploit; if exploited it has a minimal impact on the software and the user.
Moderate – the vulnerability is difficult to exploit; exploiting the vulnerability is directly related to certain factors (default configuration, auditing, etc).
Important – the vulnerability could compromise data security; the attacker could gain access to sensitive information or could compromise processing resources.
Critical – the vulnerability can be used to run malicious native-code without the user realizing anything wrong is happening.
If you would like to get Adobe Shockwave Player 11.5.2.602, a download location is available here.
