VARIoT IoT vulnerabilities database
| VAR-201005-0071 | CVE-2010-0602 | Cisco PGW 2200 Softswitch of SIP Service disruption in implementation (DoS) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
The SIP implementation on the Cisco PGW 2200 Softswitch with software before 9.7(3)S11 allows remote attackers to cause a denial of service (device crash) via a malformed packet, aka Bug ID CSCsk32606. Cisco PGW 2200 Softswitch is prone to a remote denial-of-service vulnerability.
An attacker can exploit this issue to cause an affected device to crash, effectively denying service to a legitimate user. This issue is tracked by Cisco BugID CSCsk32606.
NOTE: This issue was previously documented in BID 40110 (Cisco PGW 2200 Softswitch Multiple Denial of Service Vulnerabilities), but has been given its own record to better document it. The Cisco PGW 2200 is a carrier-grade software switch that can be used to perform call control in NGN and IMS infrastructures. The bug ID is CSCsk32606. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Multiple vulnerabilities in Cisco PGW Softswitch
Document ID: 111870
Advisory ID: cisco-sa-20100512-pgw
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Revision 1.0
For Public Release 2010 May 12 1600 UTC (GMT)
- ---------------------------------------------------------------------
Summary
=======
Multiple vulnerabilities exist in the Cisco PGW 2200 Softswitch
series of products. Each vulnerability described in this advisory is
independent from other. The vulnerabilities are related to processing
Session Initiation Protocol (SIP) or Media Gateway Control Protocol
(MGCP) messages.
Successful exploitation of all but one of these vulnerabilities can
crash the affected device. Exploitation of the remaining
vulnerability will not crash the affected device, but it can lead to
a denial-of-service (DoS) condition in which no new TCP-based
connections will be accepted or created.
Cisco has released free software updates that address these
vulnerabilities. There are no workarounds that mitigate these
vulnerabilities.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Affected Products
=================
Vulnerable Products
+------------------
The Cisco PGW 2200 Softswitch is affected by these vulnerabilities.
The following table displays information about software releases that
are affected by individual vulnerabilities. Each vulnerability in the
table affects all software releases prior to the release that is
listed in the table.
+---------------------------------------+
| Cisco Bug | Affects All Software |
| ID | Releases Prior This |
| | Version(s) |
|------------+--------------------------|
| CSCsz13590 | 9.8(1)S5 |
|------------+--------------------------|
| CSCsl39126 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk32606 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk44115 | 9.7(3)S11, 9.7(3)P11 |
|------------+--------------------------|
| CSCsk40030 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsk38165 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsj98521 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk04588 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk13561 | 9.7(3)S9, 9.7(3)P9 |
+---------------------------------------+
To determine the software version running on a Cisco product, log in
to the device and issue the RTRV-NE command. This command displays
information about the Cisco PGW 2200 Softswitch hardware, software,
and current state.
The following example identifies a Cisco PGW 2200 Softswitch running
software release 9.7(3):
mml> RTRV-NE
Media Gateway Controller - MGC-01 2010-04-23 11:55:00.000
M RTRV
"Type:MGC (Switch Mode)"
"Hardware platform:sun4u sparc SUNW,Sun-Fire-V210"
"Vendor:"Cisco Systems, Inc.""
"Location:MGC-01 - Media Gateway Controller"
"Version:"9.7(3)""
"Patch:"CSCOgs028/CSCOnn028""
"Platform State:ACTIVE"
;
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities. In particular, Cisco IOS Software is not affected by
these vulnerabilities.
Details
=======
SIP is a popular signaling protocol used to manage voice and video
calls across IP networks such as the Internet. SIP is responsible for
handling all aspects of call setup and termination. Voice and video
are the most popular types of sessions that SIP handles, but the
protocol is flexible to accommodate for other applications that
require call setup and termination. SIP call signaling can use UDP
(port 5060), TCP (port 5060), or Transport Layer Security (TLS; TCP
port 5061) as the underlying transport protocol.
MGCP is the protocol for controlling telephony gateways from external
call control elements known as media gateway controllers or call
agents. A telephony gateway is a network element that provides
conversion between the audio signals carried on telephone circuits
and data packets carried over the Internet or other packet networks.
Multiple DoS vulnerabilities exist in the Cisco PGW 2200 Softswitch
SIP implementation, and one vulnerability is in the MGCP
implementation.
The following vulnerabilities can cause affected devices to crash:
* CSCsl39126 (registered customers only), CVE ID CVE-2010-0601
* CSCsk32606 (registered customers only), CVE ID CVE-2010-0602
* CSCsk40030 (registered customers only), CVE ID CVE-2010-0603
* CSCsk38165 (registered customers only), CVE ID CVE-2010-0604
* CSCsk44115 (registered customers only), CVE ID CVE-2010-1561
* CSCsj98521 (registered customers only), CVE ID CVE-2010-1562
* CSCsk04588 (registered customers only), CVE ID CVE-2010-1563
* CSCsz13590 (registered customers only), CVE ID CVE-2010-1567
The following vulnerability may cause an affected device to be unable
to accept or create a new TCP connection. Existing calls will not be
terminated, but no new SIP connections will be established. If
exploited, this vulnerability will also prevent the device from
establishing any new HTTP, SSH or Telnet sessions.
* CSCsk13561 (registered customers only), CVE ID CVE-2010-1565
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this security advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsl39126 - Malformed MGCP packet can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk32606 - Malformed SIP packet can crash device
CSCsk40030 - Malformed Session Attribute can crash device
CSCsk38165 - Device crash during SIP testing
CSCsk44115 - Device crash while processing overly long message
CSCsj98521 - Device crash while processing malformed Contact Header
CSCsk04588 - Device crash while processing malformed header
CSCsz13590 - Malformed SIP header can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk13561 - Exhaustion of TCP sockets prevents device from accepting
new connections
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
Impact
======
Successful exploitation of all but one vulnerability in this advisory
can crash the affected device. The remaining vulnerability will not
crash the affected device, but it can lead to a DoS condition in
which no new TCP-based connections will be accepted or created.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
All vulnerabilities listed in this Security Advisory are addressed in
Cisco PGW 2200 Softswitch version 9.7(3)S11, version 9.8(1)S5, and
subsequent, software releases.
Workarounds
===========
There are no workarounds for the vulnerabilities in this advisory.
In the case of the vulnerability that corresponds to Cisco Bug ID
CSCsk13561, administrator must manually reboot the affected device to
restore the device's ability to accept new connections. Because
vulnerability prevents new TCP-based session to be created, this
reboot can be initiated only from the console. If a failover device
is configured, existing sessions will continue while the affected
device is reloading. Without a failover device, all active sessions
will be terminated while the affected device is reloading.
Additional mitigation techniques that can be deployed on Cisco
devices within the network are available in the Cisco Applied
Mitigation Bulletin companion document for this advisory:
http://www.cisco.com/warp/public/707/cisco-amb-20100512-pgw.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were discovered during internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-May-12 | public |
| | | release. |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices.
All Cisco security advisories are available at
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)
iEYEARECAAYFAkvqxeUACgkQ86n/Gc8U/uDSSACaAkFu2uZrHTxH/nHA+t3EH05g
3LcAnjmSVqwTjrB3Ck5IuAopPY2iBssX
=dBOb
-----END PGP SIGNATURE-----
| VAR-201005-0073 | CVE-2010-0604 | Cisco PGW 2200 Softswitch of SIP Service disruption in implementation (DoS) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in the SIP implementation on the Cisco PGW 2200 Softswitch with software before 9.7(3)S10 allows remote attackers to cause a denial of service (device crash) via unknown SIP traffic, as demonstrated by "SIP testing," aka Bug ID CSCsk38165. Cisco PGW 2200 Softswitch is prone to a remote denial-of-service vulnerability.
An attacker can exploit this issue to cause an affected device to crash, effectively denying service to a legitimate user. This issue is tracked by Cisco BugID CSCsk38165.
NOTE: This issue was previously documented in BID 40110 (Cisco PGW 2200 Softswitch Multiple Denial of Service Vulnerabilities), but has been given its own record to better document it. The Cisco PGW 2200 is a carrier-grade software switch that can be used to perform call control in NGN and IMS infrastructures. For example, \"SIP Testing\" can be used, and the bug ID is CSCsk40030. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Multiple vulnerabilities in Cisco PGW Softswitch
Document ID: 111870
Advisory ID: cisco-sa-20100512-pgw
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Revision 1.0
For Public Release 2010 May 12 1600 UTC (GMT)
- ---------------------------------------------------------------------
Summary
=======
Multiple vulnerabilities exist in the Cisco PGW 2200 Softswitch
series of products. Each vulnerability described in this advisory is
independent from other. The vulnerabilities are related to processing
Session Initiation Protocol (SIP) or Media Gateway Control Protocol
(MGCP) messages.
Successful exploitation of all but one of these vulnerabilities can
crash the affected device. Exploitation of the remaining
vulnerability will not crash the affected device, but it can lead to
a denial-of-service (DoS) condition in which no new TCP-based
connections will be accepted or created.
Cisco has released free software updates that address these
vulnerabilities. There are no workarounds that mitigate these
vulnerabilities.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Affected Products
=================
Vulnerable Products
+------------------
The Cisco PGW 2200 Softswitch is affected by these vulnerabilities.
The following table displays information about software releases that
are affected by individual vulnerabilities. Each vulnerability in the
table affects all software releases prior to the release that is
listed in the table.
+---------------------------------------+
| Cisco Bug | Affects All Software |
| ID | Releases Prior This |
| | Version(s) |
|------------+--------------------------|
| CSCsz13590 | 9.8(1)S5 |
|------------+--------------------------|
| CSCsl39126 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk32606 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk44115 | 9.7(3)S11, 9.7(3)P11 |
|------------+--------------------------|
| CSCsk40030 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsk38165 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsj98521 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk04588 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk13561 | 9.7(3)S9, 9.7(3)P9 |
+---------------------------------------+
To determine the software version running on a Cisco product, log in
to the device and issue the RTRV-NE command. This command displays
information about the Cisco PGW 2200 Softswitch hardware, software,
and current state.
The following example identifies a Cisco PGW 2200 Softswitch running
software release 9.7(3):
mml> RTRV-NE
Media Gateway Controller - MGC-01 2010-04-23 11:55:00.000
M RTRV
"Type:MGC (Switch Mode)"
"Hardware platform:sun4u sparc SUNW,Sun-Fire-V210"
"Vendor:"Cisco Systems, Inc.""
"Location:MGC-01 - Media Gateway Controller"
"Version:"9.7(3)""
"Patch:"CSCOgs028/CSCOnn028""
"Platform State:ACTIVE"
;
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities. In particular, Cisco IOS Software is not affected by
these vulnerabilities.
Details
=======
SIP is a popular signaling protocol used to manage voice and video
calls across IP networks such as the Internet. SIP is responsible for
handling all aspects of call setup and termination. Voice and video
are the most popular types of sessions that SIP handles, but the
protocol is flexible to accommodate for other applications that
require call setup and termination. SIP call signaling can use UDP
(port 5060), TCP (port 5060), or Transport Layer Security (TLS; TCP
port 5061) as the underlying transport protocol.
MGCP is the protocol for controlling telephony gateways from external
call control elements known as media gateway controllers or call
agents. A telephony gateway is a network element that provides
conversion between the audio signals carried on telephone circuits
and data packets carried over the Internet or other packet networks.
The following vulnerabilities can cause affected devices to crash:
* CSCsl39126 (registered customers only), CVE ID CVE-2010-0601
* CSCsk32606 (registered customers only), CVE ID CVE-2010-0602
* CSCsk40030 (registered customers only), CVE ID CVE-2010-0603
* CSCsk38165 (registered customers only), CVE ID CVE-2010-0604
* CSCsk44115 (registered customers only), CVE ID CVE-2010-1561
* CSCsj98521 (registered customers only), CVE ID CVE-2010-1562
* CSCsk04588 (registered customers only), CVE ID CVE-2010-1563
* CSCsz13590 (registered customers only), CVE ID CVE-2010-1567
The following vulnerability may cause an affected device to be unable
to accept or create a new TCP connection. Existing calls will not be
terminated, but no new SIP connections will be established. If
exploited, this vulnerability will also prevent the device from
establishing any new HTTP, SSH or Telnet sessions.
* CSCsk13561 (registered customers only), CVE ID CVE-2010-1565
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this security advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsl39126 - Malformed MGCP packet can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk32606 - Malformed SIP packet can crash device
CSCsk40030 - Malformed Session Attribute can crash device
CSCsk38165 - Device crash during SIP testing
CSCsk44115 - Device crash while processing overly long message
CSCsj98521 - Device crash while processing malformed Contact Header
CSCsk04588 - Device crash while processing malformed header
CSCsz13590 - Malformed SIP header can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk13561 - Exhaustion of TCP sockets prevents device from accepting
new connections
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
Impact
======
Successful exploitation of all but one vulnerability in this advisory
can crash the affected device. The remaining vulnerability will not
crash the affected device, but it can lead to a DoS condition in
which no new TCP-based connections will be accepted or created.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
All vulnerabilities listed in this Security Advisory are addressed in
Cisco PGW 2200 Softswitch version 9.7(3)S11, version 9.8(1)S5, and
subsequent, software releases.
Workarounds
===========
There are no workarounds for the vulnerabilities in this advisory.
In the case of the vulnerability that corresponds to Cisco Bug ID
CSCsk13561, administrator must manually reboot the affected device to
restore the device's ability to accept new connections. Because
vulnerability prevents new TCP-based session to be created, this
reboot can be initiated only from the console. If a failover device
is configured, existing sessions will continue while the affected
device is reloading. Without a failover device, all active sessions
will be terminated while the affected device is reloading.
Additional mitigation techniques that can be deployed on Cisco
devices within the network are available in the Cisco Applied
Mitigation Bulletin companion document for this advisory:
http://www.cisco.com/warp/public/707/cisco-amb-20100512-pgw.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were discovered during internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-May-12 | public |
| | | release. |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices.
All Cisco security advisories are available at
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)
iEYEARECAAYFAkvqxeUACgkQ86n/Gc8U/uDSSACaAkFu2uZrHTxH/nHA+t3EH05g
3LcAnjmSVqwTjrB3Ck5IuAopPY2iBssX
=dBOb
-----END PGP SIGNATURE-----
| VAR-201005-0171 | CVE-2010-1561 | Cisco PGW 2200 Softswitch of SIP Service disruption in implementation (DoS) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
The SIP implementation on the Cisco PGW 2200 Softswitch with software 9.7(3)S before 9.7(3)S11 and 9.7(3)P before 9.7(3)P11 allows remote attackers to cause a denial of service (device crash) via a long message, aka Bug ID CSCsk44115. The Cisco PGW 2200 Softswitch is a software switch for Cisco's unified communications solution. The Cisco PGW 2200 Softswitch has a problem with SIP test requests. A remote attacker can exploit the vulnerability to perform a denial of service attack on the device. The Cisco PGW 2200 Softswitch has a problem handling SIP packets. A remote attacker can exploit the vulnerability to perform a denial of service attack on the device. The Cisco PGW 2200 Softswitch has problems handling MGCP packets. A remote attacker can exploit the vulnerability to perform a denial of service attack on the device. The Cisco PGW 2200 Softswitch has a denial of service attack and the affected device stops receiving or establishing a new TCP connection. The established call will not be terminated, but a new SIP connection cannot be established. Any new HTTP, SSH or telnet sessions will not be able to connect. This issue is tracked by Cisco BugID CSCsk44115. The bug ID is CSCsk44115. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Multiple vulnerabilities in Cisco PGW Softswitch
Document ID: 111870
Advisory ID: cisco-sa-20100512-pgw
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Revision 1.0
For Public Release 2010 May 12 1600 UTC (GMT)
- ---------------------------------------------------------------------
Summary
=======
Multiple vulnerabilities exist in the Cisco PGW 2200 Softswitch
series of products. Each vulnerability described in this advisory is
independent from other. The vulnerabilities are related to processing
Session Initiation Protocol (SIP) or Media Gateway Control Protocol
(MGCP) messages.
Successful exploitation of all but one of these vulnerabilities can
crash the affected device. Exploitation of the remaining
vulnerability will not crash the affected device, but it can lead to
a denial-of-service (DoS) condition in which no new TCP-based
connections will be accepted or created.
Cisco has released free software updates that address these
vulnerabilities. There are no workarounds that mitigate these
vulnerabilities.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Affected Products
=================
Vulnerable Products
+------------------
The Cisco PGW 2200 Softswitch is affected by these vulnerabilities.
The following table displays information about software releases that
are affected by individual vulnerabilities. Each vulnerability in the
table affects all software releases prior to the release that is
listed in the table.
+---------------------------------------+
| Cisco Bug | Affects All Software |
| ID | Releases Prior This |
| | Version(s) |
|------------+--------------------------|
| CSCsz13590 | 9.8(1)S5 |
|------------+--------------------------|
| CSCsl39126 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk32606 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk44115 | 9.7(3)S11, 9.7(3)P11 |
|------------+--------------------------|
| CSCsk40030 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsk38165 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsj98521 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk04588 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk13561 | 9.7(3)S9, 9.7(3)P9 |
+---------------------------------------+
To determine the software version running on a Cisco product, log in
to the device and issue the RTRV-NE command.
The following example identifies a Cisco PGW 2200 Softswitch running
software release 9.7(3):
mml> RTRV-NE
Media Gateway Controller - MGC-01 2010-04-23 11:55:00.000
M RTRV
"Type:MGC (Switch Mode)"
"Hardware platform:sun4u sparc SUNW,Sun-Fire-V210"
"Vendor:"Cisco Systems, Inc.""
"Location:MGC-01 - Media Gateway Controller"
"Version:"9.7(3)""
"Patch:"CSCOgs028/CSCOnn028""
"Platform State:ACTIVE"
;
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities. In particular, Cisco IOS Software is not affected by
these vulnerabilities.
Details
=======
SIP is a popular signaling protocol used to manage voice and video
calls across IP networks such as the Internet. Voice and video
are the most popular types of sessions that SIP handles, but the
protocol is flexible to accommodate for other applications that
require call setup and termination. SIP call signaling can use UDP
(port 5060), TCP (port 5060), or Transport Layer Security (TLS; TCP
port 5061) as the underlying transport protocol.
MGCP is the protocol for controlling telephony gateways from external
call control elements known as media gateway controllers or call
agents. A telephony gateway is a network element that provides
conversion between the audio signals carried on telephone circuits
and data packets carried over the Internet or other packet networks.
Multiple DoS vulnerabilities exist in the Cisco PGW 2200 Softswitch
SIP implementation, and one vulnerability is in the MGCP
implementation.
The following vulnerabilities can cause affected devices to crash:
* CSCsl39126 (registered customers only), CVE ID CVE-2010-0601
* CSCsk32606 (registered customers only), CVE ID CVE-2010-0602
* CSCsk40030 (registered customers only), CVE ID CVE-2010-0603
* CSCsk38165 (registered customers only), CVE ID CVE-2010-0604
* CSCsk44115 (registered customers only), CVE ID CVE-2010-1561
* CSCsj98521 (registered customers only), CVE ID CVE-2010-1562
* CSCsk04588 (registered customers only), CVE ID CVE-2010-1563
* CSCsz13590 (registered customers only), CVE ID CVE-2010-1567
The following vulnerability may cause an affected device to be unable
to accept or create a new TCP connection.
* CSCsk13561 (registered customers only), CVE ID CVE-2010-1565
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this security advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsl39126 - Malformed MGCP packet can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk32606 - Malformed SIP packet can crash device
CSCsk40030 - Malformed Session Attribute can crash device
CSCsk38165 - Device crash during SIP testing
CSCsk44115 - Device crash while processing overly long message
CSCsj98521 - Device crash while processing malformed Contact Header
CSCsk04588 - Device crash while processing malformed header
CSCsz13590 - Malformed SIP header can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk13561 - Exhaustion of TCP sockets prevents device from accepting
new connections
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
Impact
======
Successful exploitation of all but one vulnerability in this advisory
can crash the affected device. The remaining vulnerability will not
crash the affected device, but it can lead to a DoS condition in
which no new TCP-based connections will be accepted or created.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
All vulnerabilities listed in this Security Advisory are addressed in
Cisco PGW 2200 Softswitch version 9.7(3)S11, version 9.8(1)S5, and
subsequent, software releases.
Workarounds
===========
There are no workarounds for the vulnerabilities in this advisory.
In the case of the vulnerability that corresponds to Cisco Bug ID
CSCsk13561, administrator must manually reboot the affected device to
restore the device's ability to accept new connections. Because
vulnerability prevents new TCP-based session to be created, this
reboot can be initiated only from the console. If a failover device
is configured, existing sessions will continue while the affected
device is reloading. Without a failover device, all active sessions
will be terminated while the affected device is reloading.
Additional mitigation techniques that can be deployed on Cisco
devices within the network are available in the Cisco Applied
Mitigation Bulletin companion document for this advisory:
http://www.cisco.com/warp/public/707/cisco-amb-20100512-pgw.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were discovered during internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-May-12 | public |
| | | release. |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices.
All Cisco security advisories are available at
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)
iEYEARECAAYFAkvqxeUACgkQ86n/Gc8U/uDSSACaAkFu2uZrHTxH/nHA+t3EH05g
3LcAnjmSVqwTjrB3Ck5IuAopPY2iBssX
=dBOb
-----END PGP SIGNATURE-----
| VAR-201005-0172 | CVE-2010-1562 | Cisco PGW 2200 Softswitch of SIP Service disruption in implementation (DoS) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
The SIP implementation on the Cisco PGW 2200 Softswitch with software 9.7(3)S before 9.7(3)S9 and 9.7(3)P before 9.7(3)P9 allows remote attackers to cause a denial of service (device crash) via a malformed Contact header, aka Bug ID CSCsj98521. Cisco PGW 2200 Softswitch is prone to a remote denial-of-service vulnerability.
An attacker can exploit this issue to cause an affected device to crash, effectively denying service to a legitimate user. This issue is tracked by Cisco BugID CSCsj98521.
NOTE: This issue was previously documented in BID 40110 (Cisco PGW 2200 Softswitch Multiple Denial of Service Vulnerabilities), but has been given its own record to better document it. The Cisco PGW 2200 is a carrier-grade software switch that can be used to perform call control in NGN and IMS infrastructures. The bug ID is CSCsj98521. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Multiple vulnerabilities in Cisco PGW Softswitch
Document ID: 111870
Advisory ID: cisco-sa-20100512-pgw
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Revision 1.0
For Public Release 2010 May 12 1600 UTC (GMT)
- ---------------------------------------------------------------------
Summary
=======
Multiple vulnerabilities exist in the Cisco PGW 2200 Softswitch
series of products. Each vulnerability described in this advisory is
independent from other. The vulnerabilities are related to processing
Session Initiation Protocol (SIP) or Media Gateway Control Protocol
(MGCP) messages.
Successful exploitation of all but one of these vulnerabilities can
crash the affected device. Exploitation of the remaining
vulnerability will not crash the affected device, but it can lead to
a denial-of-service (DoS) condition in which no new TCP-based
connections will be accepted or created.
Cisco has released free software updates that address these
vulnerabilities. There are no workarounds that mitigate these
vulnerabilities.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Affected Products
=================
Vulnerable Products
+------------------
The Cisco PGW 2200 Softswitch is affected by these vulnerabilities.
The following table displays information about software releases that
are affected by individual vulnerabilities. Each vulnerability in the
table affects all software releases prior to the release that is
listed in the table.
+---------------------------------------+
| Cisco Bug | Affects All Software |
| ID | Releases Prior This |
| | Version(s) |
|------------+--------------------------|
| CSCsz13590 | 9.8(1)S5 |
|------------+--------------------------|
| CSCsl39126 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk32606 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk44115 | 9.7(3)S11, 9.7(3)P11 |
|------------+--------------------------|
| CSCsk40030 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsk38165 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsj98521 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk04588 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk13561 | 9.7(3)S9, 9.7(3)P9 |
+---------------------------------------+
To determine the software version running on a Cisco product, log in
to the device and issue the RTRV-NE command. This command displays
information about the Cisco PGW 2200 Softswitch hardware, software,
and current state.
The following example identifies a Cisco PGW 2200 Softswitch running
software release 9.7(3):
mml> RTRV-NE
Media Gateway Controller - MGC-01 2010-04-23 11:55:00.000
M RTRV
"Type:MGC (Switch Mode)"
"Hardware platform:sun4u sparc SUNW,Sun-Fire-V210"
"Vendor:"Cisco Systems, Inc.""
"Location:MGC-01 - Media Gateway Controller"
"Version:"9.7(3)""
"Patch:"CSCOgs028/CSCOnn028""
"Platform State:ACTIVE"
;
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities. In particular, Cisco IOS Software is not affected by
these vulnerabilities.
Details
=======
SIP is a popular signaling protocol used to manage voice and video
calls across IP networks such as the Internet. SIP is responsible for
handling all aspects of call setup and termination. Voice and video
are the most popular types of sessions that SIP handles, but the
protocol is flexible to accommodate for other applications that
require call setup and termination. SIP call signaling can use UDP
(port 5060), TCP (port 5060), or Transport Layer Security (TLS; TCP
port 5061) as the underlying transport protocol.
MGCP is the protocol for controlling telephony gateways from external
call control elements known as media gateway controllers or call
agents. A telephony gateway is a network element that provides
conversion between the audio signals carried on telephone circuits
and data packets carried over the Internet or other packet networks.
Multiple DoS vulnerabilities exist in the Cisco PGW 2200 Softswitch
SIP implementation, and one vulnerability is in the MGCP
implementation.
The following vulnerabilities can cause affected devices to crash:
* CSCsl39126 (registered customers only), CVE ID CVE-2010-0601
* CSCsk32606 (registered customers only), CVE ID CVE-2010-0602
* CSCsk40030 (registered customers only), CVE ID CVE-2010-0603
* CSCsk38165 (registered customers only), CVE ID CVE-2010-0604
* CSCsk44115 (registered customers only), CVE ID CVE-2010-1561
* CSCsj98521 (registered customers only), CVE ID CVE-2010-1562
* CSCsk04588 (registered customers only), CVE ID CVE-2010-1563
* CSCsz13590 (registered customers only), CVE ID CVE-2010-1567
The following vulnerability may cause an affected device to be unable
to accept or create a new TCP connection. Existing calls will not be
terminated, but no new SIP connections will be established. If
exploited, this vulnerability will also prevent the device from
establishing any new HTTP, SSH or Telnet sessions.
* CSCsk13561 (registered customers only), CVE ID CVE-2010-1565
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this security advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsl39126 - Malformed MGCP packet can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk32606 - Malformed SIP packet can crash device
CSCsk40030 - Malformed Session Attribute can crash device
CSCsk38165 - Device crash during SIP testing
CSCsk44115 - Device crash while processing overly long message
CSCsj98521 - Device crash while processing malformed Contact Header
CSCsk04588 - Device crash while processing malformed header
CSCsz13590 - Malformed SIP header can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk13561 - Exhaustion of TCP sockets prevents device from accepting
new connections
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
Impact
======
Successful exploitation of all but one vulnerability in this advisory
can crash the affected device. The remaining vulnerability will not
crash the affected device, but it can lead to a DoS condition in
which no new TCP-based connections will be accepted or created.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
All vulnerabilities listed in this Security Advisory are addressed in
Cisco PGW 2200 Softswitch version 9.7(3)S11, version 9.8(1)S5, and
subsequent, software releases.
Workarounds
===========
There are no workarounds for the vulnerabilities in this advisory.
In the case of the vulnerability that corresponds to Cisco Bug ID
CSCsk13561, administrator must manually reboot the affected device to
restore the device's ability to accept new connections. Because
vulnerability prevents new TCP-based session to be created, this
reboot can be initiated only from the console. If a failover device
is configured, existing sessions will continue while the affected
device is reloading. Without a failover device, all active sessions
will be terminated while the affected device is reloading.
Additional mitigation techniques that can be deployed on Cisco
devices within the network are available in the Cisco Applied
Mitigation Bulletin companion document for this advisory:
http://www.cisco.com/warp/public/707/cisco-amb-20100512-pgw.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were discovered during internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-May-12 | public |
| | | release. |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices.
All Cisco security advisories are available at
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)
iEYEARECAAYFAkvqxeUACgkQ86n/Gc8U/uDSSACaAkFu2uZrHTxH/nHA+t3EH05g
3LcAnjmSVqwTjrB3Ck5IuAopPY2iBssX
=dBOb
-----END PGP SIGNATURE-----
| VAR-201005-0070 | CVE-2010-0601 | Cisco PGW 2200 Softswitch of MGCP Service disruption in implementation (DoS) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
The MGCP implementation on the Cisco PGW 2200 Softswitch with software before 9.7(3)S11 allows remote attackers to cause a denial of service (device crash) via a malformed packet, aka Bug ID CSCsl39126. Cisco PGW 2200 Softswitch is prone to a remote denial-of-service vulnerability.
An attacker can exploit this issue to cause an affected device to crash, effectively denying service to a legitimate user. This issue is tracked by Cisco BugID CSCsl39126.
NOTE: This issue was previously documented in BID 40110 (Cisco PGW 2200 Softswitch Multiple Denial of Service Vulnerabilities), but has been given its own record to better document it. The PGW 2200 is a carrier-grade software switch that can be used to perform call control in NGN and IMS infrastructures. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Multiple vulnerabilities in Cisco PGW Softswitch
Document ID: 111870
Advisory ID: cisco-sa-20100512-pgw
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Revision 1.0
For Public Release 2010 May 12 1600 UTC (GMT)
- ---------------------------------------------------------------------
Summary
=======
Multiple vulnerabilities exist in the Cisco PGW 2200 Softswitch
series of products. Each vulnerability described in this advisory is
independent from other. The vulnerabilities are related to processing
Session Initiation Protocol (SIP) or Media Gateway Control Protocol
(MGCP) messages.
Successful exploitation of all but one of these vulnerabilities can
crash the affected device. Exploitation of the remaining
vulnerability will not crash the affected device, but it can lead to
a denial-of-service (DoS) condition in which no new TCP-based
connections will be accepted or created.
Cisco has released free software updates that address these
vulnerabilities. There are no workarounds that mitigate these
vulnerabilities.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Affected Products
=================
Vulnerable Products
+------------------
The Cisco PGW 2200 Softswitch is affected by these vulnerabilities.
The following table displays information about software releases that
are affected by individual vulnerabilities. Each vulnerability in the
table affects all software releases prior to the release that is
listed in the table. This command displays
information about the Cisco PGW 2200 Softswitch hardware, software,
and current state.
The following example identifies a Cisco PGW 2200 Softswitch running
software release 9.7(3):
mml> RTRV-NE
Media Gateway Controller - MGC-01 2010-04-23 11:55:00.000
M RTRV
"Type:MGC (Switch Mode)"
"Hardware platform:sun4u sparc SUNW,Sun-Fire-V210"
"Vendor:"Cisco Systems, Inc.""
"Location:MGC-01 - Media Gateway Controller"
"Version:"9.7(3)""
"Patch:"CSCOgs028/CSCOnn028""
"Platform State:ACTIVE"
;
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities. In particular, Cisco IOS Software is not affected by
these vulnerabilities.
Details
=======
SIP is a popular signaling protocol used to manage voice and video
calls across IP networks such as the Internet. SIP is responsible for
handling all aspects of call setup and termination. Voice and video
are the most popular types of sessions that SIP handles, but the
protocol is flexible to accommodate for other applications that
require call setup and termination. SIP call signaling can use UDP
(port 5060), TCP (port 5060), or Transport Layer Security (TLS; TCP
port 5061) as the underlying transport protocol.
MGCP is the protocol for controlling telephony gateways from external
call control elements known as media gateway controllers or call
agents. A telephony gateway is a network element that provides
conversion between the audio signals carried on telephone circuits
and data packets carried over the Internet or other packet networks.
Multiple DoS vulnerabilities exist in the Cisco PGW 2200 Softswitch
SIP implementation, and one vulnerability is in the MGCP
implementation.
The following vulnerabilities can cause affected devices to crash:
* CSCsl39126 (registered customers only), CVE ID CVE-2010-0601
* CSCsk32606 (registered customers only), CVE ID CVE-2010-0602
* CSCsk40030 (registered customers only), CVE ID CVE-2010-0603
* CSCsk38165 (registered customers only), CVE ID CVE-2010-0604
* CSCsk44115 (registered customers only), CVE ID CVE-2010-1561
* CSCsj98521 (registered customers only), CVE ID CVE-2010-1562
* CSCsk04588 (registered customers only), CVE ID CVE-2010-1563
* CSCsz13590 (registered customers only), CVE ID CVE-2010-1567
The following vulnerability may cause an affected device to be unable
to accept or create a new TCP connection. Existing calls will not be
terminated, but no new SIP connections will be established. If
exploited, this vulnerability will also prevent the device from
establishing any new HTTP, SSH or Telnet sessions.
* CSCsk13561 (registered customers only), CVE ID CVE-2010-1565
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this security advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsl39126 - Malformed MGCP packet can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk32606 - Malformed SIP packet can crash device
CSCsk40030 - Malformed Session Attribute can crash device
CSCsk38165 - Device crash during SIP testing
CSCsk44115 - Device crash while processing overly long message
CSCsj98521 - Device crash while processing malformed Contact Header
CSCsk04588 - Device crash while processing malformed header
CSCsz13590 - Malformed SIP header can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk13561 - Exhaustion of TCP sockets prevents device from accepting
new connections
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
Impact
======
Successful exploitation of all but one vulnerability in this advisory
can crash the affected device. The remaining vulnerability will not
crash the affected device, but it can lead to a DoS condition in
which no new TCP-based connections will be accepted or created.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
All vulnerabilities listed in this Security Advisory are addressed in
Cisco PGW 2200 Softswitch version 9.7(3)S11, version 9.8(1)S5, and
subsequent, software releases.
Workarounds
===========
There are no workarounds for the vulnerabilities in this advisory.
In the case of the vulnerability that corresponds to Cisco Bug ID
CSCsk13561, administrator must manually reboot the affected device to
restore the device's ability to accept new connections. Because
vulnerability prevents new TCP-based session to be created, this
reboot can be initiated only from the console. If a failover device
is configured, existing sessions will continue while the affected
device is reloading. Without a failover device, all active sessions
will be terminated while the affected device is reloading.
Additional mitigation techniques that can be deployed on Cisco
devices within the network are available in the Cisco Applied
Mitigation Bulletin companion document for this advisory:
http://www.cisco.com/warp/public/707/cisco-amb-20100512-pgw.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were discovered during internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-May-12 | public |
| | | release. |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices.
All Cisco security advisories are available at
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)
iEYEARECAAYFAkvqxeUACgkQ86n/Gc8U/uDSSACaAkFu2uZrHTxH/nHA+t3EH05g
3LcAnjmSVqwTjrB3Ck5IuAopPY2iBssX
=dBOb
-----END PGP SIGNATURE-----
| VAR-201005-0072 | CVE-2010-0603 | Cisco PGW 2200 Softswitch of SIP Service disruption in implementation (DoS) Vulnerabilities |
CVSS V2: 7.8 CVSS V3: - Severity: HIGH |
The SIP implementation on the Cisco PGW 2200 Softswitch with software before 9.7(3)S10 allows remote attackers to cause a denial of service (device crash) via a malformed session attribute, aka Bug ID CSCsk40030. Cisco PGW 2200 Softswitch is prone to a remote denial-of-service vulnerability.
An attacker can exploit this issue to cause an affected device to crash, effectively denying service to a legitimate user. This issue is tracked by Cisco BugID CSCsk40030.
NOTE: This issue was previously documented in BID 40110 (Cisco PGW 2200 Softswitch Multiple Denial of Service Vulnerabilities), but has been given its own record to better document it. The Cisco PGW 2200 is a carrier-grade software switch that can be used to perform call control in NGN and IMS infrastructures. The bug ID is CSCsk40030. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Multiple vulnerabilities in Cisco PGW Softswitch
Document ID: 111870
Advisory ID: cisco-sa-20100512-pgw
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Revision 1.0
For Public Release 2010 May 12 1600 UTC (GMT)
- ---------------------------------------------------------------------
Summary
=======
Multiple vulnerabilities exist in the Cisco PGW 2200 Softswitch
series of products. Each vulnerability described in this advisory is
independent from other. The vulnerabilities are related to processing
Session Initiation Protocol (SIP) or Media Gateway Control Protocol
(MGCP) messages.
Successful exploitation of all but one of these vulnerabilities can
crash the affected device. Exploitation of the remaining
vulnerability will not crash the affected device, but it can lead to
a denial-of-service (DoS) condition in which no new TCP-based
connections will be accepted or created.
Cisco has released free software updates that address these
vulnerabilities. There are no workarounds that mitigate these
vulnerabilities.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
Affected Products
=================
Vulnerable Products
+------------------
The Cisco PGW 2200 Softswitch is affected by these vulnerabilities.
The following table displays information about software releases that
are affected by individual vulnerabilities. Each vulnerability in the
table affects all software releases prior to the release that is
listed in the table.
+---------------------------------------+
| Cisco Bug | Affects All Software |
| ID | Releases Prior This |
| | Version(s) |
|------------+--------------------------|
| CSCsz13590 | 9.8(1)S5 |
|------------+--------------------------|
| CSCsl39126 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk32606 | 9.7(3)S11 |
|------------+--------------------------|
| CSCsk44115 | 9.7(3)S11, 9.7(3)P11 |
|------------+--------------------------|
| CSCsk40030 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsk38165 | 9.7(3)S10 |
|------------+--------------------------|
| CSCsj98521 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk04588 | 9.7(3)S9, 9.7(3)P9 |
|------------+--------------------------|
| CSCsk13561 | 9.7(3)S9, 9.7(3)P9 |
+---------------------------------------+
To determine the software version running on a Cisco product, log in
to the device and issue the RTRV-NE command. This command displays
information about the Cisco PGW 2200 Softswitch hardware, software,
and current state.
The following example identifies a Cisco PGW 2200 Softswitch running
software release 9.7(3):
mml> RTRV-NE
Media Gateway Controller - MGC-01 2010-04-23 11:55:00.000
M RTRV
"Type:MGC (Switch Mode)"
"Hardware platform:sun4u sparc SUNW,Sun-Fire-V210"
"Vendor:"Cisco Systems, Inc.""
"Location:MGC-01 - Media Gateway Controller"
"Version:"9.7(3)""
"Patch:"CSCOgs028/CSCOnn028""
"Platform State:ACTIVE"
;
Products Confirmed Not Vulnerable
+--------------------------------
No other Cisco products are currently known to be affected by these
vulnerabilities. In particular, Cisco IOS Software is not affected by
these vulnerabilities.
Details
=======
SIP is a popular signaling protocol used to manage voice and video
calls across IP networks such as the Internet. SIP is responsible for
handling all aspects of call setup and termination. Voice and video
are the most popular types of sessions that SIP handles, but the
protocol is flexible to accommodate for other applications that
require call setup and termination. SIP call signaling can use UDP
(port 5060), TCP (port 5060), or Transport Layer Security (TLS; TCP
port 5061) as the underlying transport protocol.
MGCP is the protocol for controlling telephony gateways from external
call control elements known as media gateway controllers or call
agents. A telephony gateway is a network element that provides
conversion between the audio signals carried on telephone circuits
and data packets carried over the Internet or other packet networks.
Multiple DoS vulnerabilities exist in the Cisco PGW 2200 Softswitch
SIP implementation, and one vulnerability is in the MGCP
implementation.
The following vulnerabilities can cause affected devices to crash:
* CSCsl39126 (registered customers only), CVE ID CVE-2010-0601
* CSCsk32606 (registered customers only), CVE ID CVE-2010-0602
* CSCsk40030 (registered customers only), CVE ID CVE-2010-0603
* CSCsk38165 (registered customers only), CVE ID CVE-2010-0604
* CSCsk44115 (registered customers only), CVE ID CVE-2010-1561
* CSCsj98521 (registered customers only), CVE ID CVE-2010-1562
* CSCsk04588 (registered customers only), CVE ID CVE-2010-1563
* CSCsz13590 (registered customers only), CVE ID CVE-2010-1567
The following vulnerability may cause an affected device to be unable
to accept or create a new TCP connection. Existing calls will not be
terminated, but no new SIP connections will be established. If
exploited, this vulnerability will also prevent the device from
establishing any new HTTP, SSH or Telnet sessions.
* CSCsk13561 (registered customers only), CVE ID CVE-2010-1565
Vulnerability Scoring Details
=============================
Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this security advisory is done in accordance with CVSS
version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding
CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsl39126 - Malformed MGCP packet can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk32606 - Malformed SIP packet can crash device
CSCsk40030 - Malformed Session Attribute can crash device
CSCsk38165 - Device crash during SIP testing
CSCsk44115 - Device crash while processing overly long message
CSCsj98521 - Device crash while processing malformed Contact Header
CSCsk04588 - Device crash while processing malformed header
CSCsz13590 - Malformed SIP header can crash device
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
CSCsk13561 - Exhaustion of TCP sockets prevents device from accepting
new connections
CVSS Base Score - 7.8
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Complete
CVSS Temporal Score - 6.4
Exploitability Functional
Remediation Level Official Fix
Report Confidence Confirmed
Impact
======
Successful exploitation of all but one vulnerability in this advisory
can crash the affected device. The remaining vulnerability will not
crash the affected device, but it can lead to a DoS condition in
which no new TCP-based connections will be accepted or created.
Software Versions and Fixes
===========================
When considering software upgrades, also consult
http://www.cisco.com/go/psirt and any subsequent advisories to
determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.
All vulnerabilities listed in this Security Advisory are addressed in
Cisco PGW 2200 Softswitch version 9.7(3)S11, version 9.8(1)S5, and
subsequent, software releases.
Workarounds
===========
There are no workarounds for the vulnerabilities in this advisory.
In the case of the vulnerability that corresponds to Cisco Bug ID
CSCsk13561, administrator must manually reboot the affected device to
restore the device's ability to accept new connections. Because
vulnerability prevents new TCP-based session to be created, this
reboot can be initiated only from the console. If a failover device
is configured, existing sessions will continue while the affected
device is reloading. Without a failover device, all active sessions
will be terminated while the affected device is reloading.
Additional mitigation techniques that can be deployed on Cisco
devices within the network are available in the Cisco Applied
Mitigation Bulletin companion document for this advisory:
http://www.cisco.com/warp/public/707/cisco-amb-20100512-pgw.shtml
Obtaining Fixed Software
========================
Cisco has released free software updates that address these
vulnerabilities. Prior to deploying software, customers should
consult their maintenance provider or check the software for feature
set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,
or as otherwise set forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact psirt@cisco.com or security-alert@cisco.com for
software upgrades.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.
Refer to
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various
languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerabilities described in this advisory.
These vulnerabilities were discovered during internal testing.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at:
http://www.cisco.com/warp/public/707/cisco-sa-20100512-pgw.shtml
In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-bulletins@lists.first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2010-May-12 | public |
| | | release. |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco
security notices.
All Cisco security advisories are available at
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)
iEYEARECAAYFAkvqxeUACgkQ86n/Gc8U/uDSSACaAkFu2uZrHTxH/nHA+t3EH05g
3LcAnjmSVqwTjrB3Ck5IuAopPY2iBssX
=dBOb
-----END PGP SIGNATURE-----
| VAR-201005-0332 | CVE-2010-1568 | Cisco IronPort Desktop Flag Plug-in for Outlook of Send Secure Vulnerability in retrieving plain text content of e-mail in the function |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The Send Secure functionality in the Cisco IronPort Desktop Flag Plug-in for Outlook before 6.5.0-006 does not properly handle simultaneously composed messages, which might allow remote attackers to obtain cleartext contents of e-mail messages that were intended to be encrypted, aka bug 65623. Cisco IronPort Desktop Flag Plug-in for Outlook is prone to an information-disclosure vulnerability.
An attacker can exploit this issue to gain access to sensitive information that may lead to further attacks.
Cisco IronPort Desktop Flag Plug-in for Outlook versions 6.2.4.3, up to but not including 6.5.0-006, are vulnerable.
This issue is being tracked by Cisco IronPort bug 65623
| VAR-201005-0110 | CVE-2010-1291 | Adobe Shockwave Player Vulnerable to arbitrary code execution |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Adobe Shockwave Player before 11.5.7.609 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-1284, CVE-2010-1286, CVE-2010-1287, CVE-2010-1289, and CVE-2010-1290. Adobe Shockwave Player is prone to a memory-corruption vulnerability.
Adobe Shockwave Player 11.5.6.606 and prior are vulnerable.
NOTE: This issue was previously discussed in BID 40066 (Adobe Shockwave Player APSB10-12 Multiple Remote Vulnerabilities) but has been given its own record to better document it. These people now have access to some of the best the Web has to offer - including dazzling 3D games and entertainment, interactive product demonstrations, and online learning applications. The vulnerable software fails to sanitize user input when processing .dir files resulting in a crash and overwrite of a few memory registers.<br/><br/> --------------------------------------------------------------------------------<br/><br/><code> (f94.ae4): Access violation - code c0000005 (first chance)<br/> First chance exceptions are reported before any exception handling.<br/> This exception may be expected and handled.<br/> eax=20a0a0a0 ebx=207d004c ecx=00000400 edx=41414140 esi=00000000 edi=a80487d8<br/> eip=68008bd6 esp=0012de4c ebp=00000400 iopl=0 nv up ei pl nz na pe nc<br/> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00050206<br/> *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Director 11\DIRAPI.dll<br/> *** ERROR: Symbol file could not be found. Defaulted to export symbols for DIRAPI.dll - <br/> DIRAPI!Ordinal14+0x3b16:<br/> 68008bd6 2b4f04 sub ecx,dword ptr [edi+4] ds:0023:a80487dc=????????<br/><br/>-----------------------<br/><br/>EAX FFFFFFFF<br/>ECX 41414141<br/>EDX FFFFFFFF<br/>EBX 00000018<br/>ESP 0012F3B4<br/>EBP 02793578<br/>ESI 0012F3C4<br/>EDI 02793578<br/>EIP 69009F1F IML32.69009F1F<br/></code><br/>--------------------------------------------------------------------------------<br/><br/>Tested on: Microsoft Windows XP Professional SP3 (English). ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
1) A boundary error while processing FFFFFF45h Shockwave 3D blocks
can be exploited to corrupt memory.
2) A signedness error in the processing of Director files can be
exploited to corrupt memory.
3) An array indexing error when processing Director files can be
exploited to corrupt memory.
4) An integer overflow error when processing Director files can be
exploited to corrupt memory.
5) An error when processing asset entries contained in Director files
can be exploited to corrupt memory.
6) A boundary error when processing embedded fonts can be exploited
to cause a heap-based buffer overflow via a specially crafted
Director file.
7) An error when processing Director files can be exploited to
overwrite 4 bytes of memory.
8) An error in the implementation of ordinal function 1409 in
iml32.dll can be exploited to corrupt heap memory via a specially
crafted Director file.
9) An error when processing a 4-byte field inside FFFFFF49h Shockwave
3D blocks can be exploited to corrupt heap memory.
10) An unspecified error can be exploited to corrupt memory.
11) A second unspecified error can be exploited to corrupt memory.
12) A third unspecified error can be exploited to corrupt memory.
13) A fourth unspecified error can be exploited to cause a buffer
overflow.
14) A fifth unspecified error can be exploited to corrupt memory.
15) A sixth unspecified error can be exploited to corrupt memory.
16) A seventh unspecified error can be exploited to corrupt memory.
17) An error when processing signed values encountered while parsing
"pami" RIFF chunks can be exploited to corrupt memory.
The vulnerabilities are reported in versions 11.5.6.606 and prior on
Windows and Macintosh.
SOLUTION:
Update to version 11.5.7.609.
http://get.adobe.com/shockwave/
PROVIDED AND/OR DISCOVERED BY:
1-6) Alin Rad Pop, Secunia Research
The vendor also credits:
2) Nahuel Riva of Core Security Technologies.
3) Chaouki Bekrar of Vupen, Code Audit Labs, and an anonymous person
working with iDefense.
7) Chaouki Bekrar and Sebastien Renaud of Vupen, Code Audit Labs,
Gjoko Krstic of Zero Science Lab, and Chro HD of Fortinet's
FortiGuard Labs.
8, 17) an anonymous person working with ZDI.
9) Chaouki Bekrar of Vupen and an anonymous person working with ZDI.
10) Chaouki Bekrar of Vupen.
11-16) Chro HD of Fortinet's FortiGuard Labs.
CHANGELOG:
2010-05-12: Updated "Extended Description" and added PoCs for
vulnerabilities #2, #3, #4, and #6.
ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
Secunia Research:
http://secunia.com/secunia_research/2010-17/
http://secunia.com/secunia_research/2010-19/
http://secunia.com/secunia_research/2010-20/
http://secunia.com/secunia_research/2010-22/
http://secunia.com/secunia_research/2010-34/
http://secunia.com/secunia_research/2010-50/
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-087/
http://www.zerodayinitiative.com/advisories/ZDI-10-088/
http://www.zerodayinitiative.com/advisories/ZDI-10-089/
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=869
Code Audit Labs:
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0137.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0138.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0139.html
Zero Science Lab:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php
Core Security Technologies:
http://www.coresecurity.com/content/adobe-director-invalid-read
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201005-0109 | CVE-2010-1290 | Adobe Shockwave Player Vulnerable to arbitrary code execution |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Adobe Shockwave Player before 11.5.7.609 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-1284, CVE-2010-1286, CVE-2010-1287, CVE-2010-1289, and CVE-2010-1291. Adobe Shockwave Player is prone to a memory-corruption vulnerability.
Adobe Shockwave Player 11.5.6.606 and prior are vulnerable.
NOTE: This issue was previously discussed in BID 40066 (Adobe Shockwave Player APSB10-12 Multiple Remote Vulnerabilities) but has been given its own record to better document it. These people now have access to some of the best the Web has to offer - including dazzling 3D games and entertainment, interactive product demonstrations, and online learning applications. The vulnerable software fails to sanitize user input when processing .dir files resulting in a crash and overwrite of a few memory registers.<br/><br/> --------------------------------------------------------------------------------<br/><br/><code> (f94.ae4): Access violation - code c0000005 (first chance)<br/> First chance exceptions are reported before any exception handling.<br/> This exception may be expected and handled.<br/> eax=20a0a0a0 ebx=207d004c ecx=00000400 edx=41414140 esi=00000000 edi=a80487d8<br/> eip=68008bd6 esp=0012de4c ebp=00000400 iopl=0 nv up ei pl nz na pe nc<br/> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00050206<br/> *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Director 11\DIRAPI.dll<br/> *** ERROR: Symbol file could not be found. Defaulted to export symbols for DIRAPI.dll - <br/> DIRAPI!Ordinal14+0x3b16:<br/> 68008bd6 2b4f04 sub ecx,dword ptr [edi+4] ds:0023:a80487dc=????????<br/><br/>-----------------------<br/><br/>EAX FFFFFFFF<br/>ECX 41414141<br/>EDX FFFFFFFF<br/>EBX 00000018<br/>ESP 0012F3B4<br/>EBP 02793578<br/>ESI 0012F3C4<br/>EDI 02793578<br/>EIP 69009F1F IML32.69009F1F<br/></code><br/>--------------------------------------------------------------------------------<br/><br/>Tested on: Microsoft Windows XP Professional SP3 (English). ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
1) A boundary error while processing FFFFFF45h Shockwave 3D blocks
can be exploited to corrupt memory.
2) A signedness error in the processing of Director files can be
exploited to corrupt memory.
3) An array indexing error when processing Director files can be
exploited to corrupt memory.
4) An integer overflow error when processing Director files can be
exploited to corrupt memory.
5) An error when processing asset entries contained in Director files
can be exploited to corrupt memory.
6) A boundary error when processing embedded fonts can be exploited
to cause a heap-based buffer overflow via a specially crafted
Director file.
7) An error when processing Director files can be exploited to
overwrite 4 bytes of memory.
8) An error in the implementation of ordinal function 1409 in
iml32.dll can be exploited to corrupt heap memory via a specially
crafted Director file.
9) An error when processing a 4-byte field inside FFFFFF49h Shockwave
3D blocks can be exploited to corrupt heap memory.
10) An unspecified error can be exploited to corrupt memory.
11) A second unspecified error can be exploited to corrupt memory.
12) A third unspecified error can be exploited to corrupt memory.
13) A fourth unspecified error can be exploited to cause a buffer
overflow.
14) A fifth unspecified error can be exploited to corrupt memory.
15) A sixth unspecified error can be exploited to corrupt memory.
16) A seventh unspecified error can be exploited to corrupt memory.
17) An error when processing signed values encountered while parsing
"pami" RIFF chunks can be exploited to corrupt memory.
The vulnerabilities are reported in versions 11.5.6.606 and prior on
Windows and Macintosh.
SOLUTION:
Update to version 11.5.7.609.
http://get.adobe.com/shockwave/
PROVIDED AND/OR DISCOVERED BY:
1-6) Alin Rad Pop, Secunia Research
The vendor also credits:
2) Nahuel Riva of Core Security Technologies.
3) Chaouki Bekrar of Vupen, Code Audit Labs, and an anonymous person
working with iDefense.
7) Chaouki Bekrar and Sebastien Renaud of Vupen, Code Audit Labs,
Gjoko Krstic of Zero Science Lab, and Chro HD of Fortinet's
FortiGuard Labs.
8, 17) an anonymous person working with ZDI.
9) Chaouki Bekrar of Vupen and an anonymous person working with ZDI.
10) Chaouki Bekrar of Vupen.
11-16) Chro HD of Fortinet's FortiGuard Labs.
CHANGELOG:
2010-05-12: Updated "Extended Description" and added PoCs for
vulnerabilities #2, #3, #4, and #6.
ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
Secunia Research:
http://secunia.com/secunia_research/2010-17/
http://secunia.com/secunia_research/2010-19/
http://secunia.com/secunia_research/2010-20/
http://secunia.com/secunia_research/2010-22/
http://secunia.com/secunia_research/2010-34/
http://secunia.com/secunia_research/2010-50/
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-087/
http://www.zerodayinitiative.com/advisories/ZDI-10-088/
http://www.zerodayinitiative.com/advisories/ZDI-10-089/
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=869
Code Audit Labs:
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0137.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0138.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0139.html
Zero Science Lab:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php
Core Security Technologies:
http://www.coresecurity.com/content/adobe-director-invalid-read
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201005-0108 | CVE-2010-1289 | Adobe Shockwave Player Vulnerable to arbitrary code execution |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Adobe Shockwave Player before 11.5.7.609 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-1284, CVE-2010-1286, CVE-2010-1287, CVE-2010-1290, and CVE-2010-1291. Adobe Shockwave Player is prone to an unspecified remote code-execution vulnerability. Failed exploit attempts will likely result in denial-of-service conditions.
Adobe Shockwave Player 11.5.6.606 and prior are vulnerable.
NOTE: This issue was previously discussed in BID 40066 (Adobe Shockwave Player APSB10-12 Multiple Remote Vulnerabilities) but has been given its own record to better document it. These people now have access to some of the best the Web has to offer - including dazzling 3D games and entertainment, interactive product demonstrations, and online learning applications. The vulnerable software fails to sanitize user input when processing .dir files resulting in a crash and overwrite of a few memory registers.<br/><br/> --------------------------------------------------------------------------------<br/><br/><code> (f94.ae4): Access violation - code c0000005 (first chance)<br/> First chance exceptions are reported before any exception handling.<br/> This exception may be expected and handled.<br/> eax=20a0a0a0 ebx=207d004c ecx=00000400 edx=41414140 esi=00000000 edi=a80487d8<br/> eip=68008bd6 esp=0012de4c ebp=00000400 iopl=0 nv up ei pl nz na pe nc<br/> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00050206<br/> *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Director 11\DIRAPI.dll<br/> *** ERROR: Symbol file could not be found. Defaulted to export symbols for DIRAPI.dll - <br/> DIRAPI!Ordinal14+0x3b16:<br/> 68008bd6 2b4f04 sub ecx,dword ptr [edi+4] ds:0023:a80487dc=????????<br/><br/>-----------------------<br/><br/>EAX FFFFFFFF<br/>ECX 41414141<br/>EDX FFFFFFFF<br/>EBX 00000018<br/>ESP 0012F3B4<br/>EBP 02793578<br/>ESI 0012F3C4<br/>EDI 02793578<br/>EIP 69009F1F IML32.69009F1F<br/></code><br/>--------------------------------------------------------------------------------<br/><br/>Tested on: Microsoft Windows XP Professional SP3 (English). ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
1) A boundary error while processing FFFFFF45h Shockwave 3D blocks
can be exploited to corrupt memory.
2) A signedness error in the processing of Director files can be
exploited to corrupt memory.
3) An array indexing error when processing Director files can be
exploited to corrupt memory.
4) An integer overflow error when processing Director files can be
exploited to corrupt memory.
5) An error when processing asset entries contained in Director files
can be exploited to corrupt memory.
6) A boundary error when processing embedded fonts can be exploited
to cause a heap-based buffer overflow via a specially crafted
Director file.
7) An error when processing Director files can be exploited to
overwrite 4 bytes of memory.
8) An error in the implementation of ordinal function 1409 in
iml32.dll can be exploited to corrupt heap memory via a specially
crafted Director file.
9) An error when processing a 4-byte field inside FFFFFF49h Shockwave
3D blocks can be exploited to corrupt heap memory.
10) An unspecified error can be exploited to corrupt memory.
11) A second unspecified error can be exploited to corrupt memory.
12) A third unspecified error can be exploited to corrupt memory.
13) A fourth unspecified error can be exploited to cause a buffer
overflow.
14) A fifth unspecified error can be exploited to corrupt memory.
15) A sixth unspecified error can be exploited to corrupt memory.
16) A seventh unspecified error can be exploited to corrupt memory.
17) An error when processing signed values encountered while parsing
"pami" RIFF chunks can be exploited to corrupt memory.
The vulnerabilities are reported in versions 11.5.6.606 and prior on
Windows and Macintosh.
SOLUTION:
Update to version 11.5.7.609.
http://get.adobe.com/shockwave/
PROVIDED AND/OR DISCOVERED BY:
1-6) Alin Rad Pop, Secunia Research
The vendor also credits:
2) Nahuel Riva of Core Security Technologies.
3) Chaouki Bekrar of Vupen, Code Audit Labs, and an anonymous person
working with iDefense.
7) Chaouki Bekrar and Sebastien Renaud of Vupen, Code Audit Labs,
Gjoko Krstic of Zero Science Lab, and Chro HD of Fortinet's
FortiGuard Labs.
8, 17) an anonymous person working with ZDI.
9) Chaouki Bekrar of Vupen and an anonymous person working with ZDI.
10) Chaouki Bekrar of Vupen.
11-16) Chro HD of Fortinet's FortiGuard Labs.
CHANGELOG:
2010-05-12: Updated "Extended Description" and added PoCs for
vulnerabilities #2, #3, #4, and #6.
ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
Secunia Research:
http://secunia.com/secunia_research/2010-17/
http://secunia.com/secunia_research/2010-19/
http://secunia.com/secunia_research/2010-20/
http://secunia.com/secunia_research/2010-22/
http://secunia.com/secunia_research/2010-34/
http://secunia.com/secunia_research/2010-50/
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-087/
http://www.zerodayinitiative.com/advisories/ZDI-10-088/
http://www.zerodayinitiative.com/advisories/ZDI-10-089/
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=869
Code Audit Labs:
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0137.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0138.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0139.html
Zero Science Lab:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php
Core Security Technologies:
http://www.coresecurity.com/content/adobe-director-invalid-read
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201005-0105 | CVE-2010-1286 | Adobe Shockwave Player Vulnerable to arbitrary code execution |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Adobe Shockwave Player before 11.5.7.609 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-1284, CVE-2010-1287, CVE-2010-1289, CVE-2010-1290, and CVE-2010-1291. Adobe Shockwave Player is prone to a memory-corruption vulnerability.
Adobe Shockwave Player 11.5.6.606 and prior are vulnerable.
NOTE: This issue was previously discussed in BID 40066 (Adobe Shockwave Player APSB10-12 Multiple Remote Vulnerabilities) but has been given its own record to better document it. These people now have access to some of the best the Web has to offer - including dazzling 3D games and entertainment, interactive product demonstrations, and online learning applications. The vulnerable software fails to sanitize user input when processing .dir files resulting in a crash and overwrite of a few memory registers.<br/><br/> --------------------------------------------------------------------------------<br/><br/><code> (f94.ae4): Access violation - code c0000005 (first chance)<br/> First chance exceptions are reported before any exception handling.<br/> This exception may be expected and handled.<br/> eax=20a0a0a0 ebx=207d004c ecx=00000400 edx=41414140 esi=00000000 edi=a80487d8<br/> eip=68008bd6 esp=0012de4c ebp=00000400 iopl=0 nv up ei pl nz na pe nc<br/> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00050206<br/> *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Director 11\DIRAPI.dll<br/> *** ERROR: Symbol file could not be found. Defaulted to export symbols for DIRAPI.dll - <br/> DIRAPI!Ordinal14+0x3b16:<br/> 68008bd6 2b4f04 sub ecx,dword ptr [edi+4] ds:0023:a80487dc=????????<br/><br/>-----------------------<br/><br/>EAX FFFFFFFF<br/>ECX 41414141<br/>EDX FFFFFFFF<br/>EBX 00000018<br/>ESP 0012F3B4<br/>EBP 02793578<br/>ESI 0012F3C4<br/>EDI 02793578<br/>EIP 69009F1F IML32.69009F1F<br/></code><br/>--------------------------------------------------------------------------------<br/><br/>Tested on: Microsoft Windows XP Professional SP3 (English). ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
1) A boundary error while processing FFFFFF45h Shockwave 3D blocks
can be exploited to corrupt memory.
2) A signedness error in the processing of Director files can be
exploited to corrupt memory.
3) An array indexing error when processing Director files can be
exploited to corrupt memory.
4) An integer overflow error when processing Director files can be
exploited to corrupt memory.
5) An error when processing asset entries contained in Director files
can be exploited to corrupt memory.
6) A boundary error when processing embedded fonts can be exploited
to cause a heap-based buffer overflow via a specially crafted
Director file.
7) An error when processing Director files can be exploited to
overwrite 4 bytes of memory.
8) An error in the implementation of ordinal function 1409 in
iml32.dll can be exploited to corrupt heap memory via a specially
crafted Director file.
9) An error when processing a 4-byte field inside FFFFFF49h Shockwave
3D blocks can be exploited to corrupt heap memory.
10) An unspecified error can be exploited to corrupt memory.
11) A second unspecified error can be exploited to corrupt memory.
12) A third unspecified error can be exploited to corrupt memory.
13) A fourth unspecified error can be exploited to cause a buffer
overflow.
14) A fifth unspecified error can be exploited to corrupt memory.
15) A sixth unspecified error can be exploited to corrupt memory.
16) A seventh unspecified error can be exploited to corrupt memory.
17) An error when processing signed values encountered while parsing
"pami" RIFF chunks can be exploited to corrupt memory.
The vulnerabilities are reported in versions 11.5.6.606 and prior on
Windows and Macintosh.
SOLUTION:
Update to version 11.5.7.609.
http://get.adobe.com/shockwave/
PROVIDED AND/OR DISCOVERED BY:
1-6) Alin Rad Pop, Secunia Research
The vendor also credits:
2) Nahuel Riva of Core Security Technologies.
3) Chaouki Bekrar of Vupen, Code Audit Labs, and an anonymous person
working with iDefense.
7) Chaouki Bekrar and Sebastien Renaud of Vupen, Code Audit Labs,
Gjoko Krstic of Zero Science Lab, and Chro HD of Fortinet's
FortiGuard Labs.
8, 17) an anonymous person working with ZDI.
9) Chaouki Bekrar of Vupen and an anonymous person working with ZDI.
10) Chaouki Bekrar of Vupen.
11-16) Chro HD of Fortinet's FortiGuard Labs.
CHANGELOG:
2010-05-12: Updated "Extended Description" and added PoCs for
vulnerabilities #2, #3, #4, and #6.
ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
Secunia Research:
http://secunia.com/secunia_research/2010-17/
http://secunia.com/secunia_research/2010-19/
http://secunia.com/secunia_research/2010-20/
http://secunia.com/secunia_research/2010-22/
http://secunia.com/secunia_research/2010-34/
http://secunia.com/secunia_research/2010-50/
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-087/
http://www.zerodayinitiative.com/advisories/ZDI-10-088/
http://www.zerodayinitiative.com/advisories/ZDI-10-089/
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=869
Code Audit Labs:
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0137.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0138.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0139.html
Zero Science Lab:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php
Core Security Technologies:
http://www.coresecurity.com/content/adobe-director-invalid-read
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201005-0106 | CVE-2010-1287 | Adobe Shockwave Player Vulnerable to arbitrary code execution |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Adobe Shockwave Player before 11.5.7.609 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-1284, CVE-2010-1286, CVE-2010-1289, CVE-2010-1290, and CVE-2010-1291. Adobe Shockwave Player is prone to a memory-corruption vulnerability.
Adobe Shockwave Player 11.5.6.606 and prior are vulnerable.
NOTE: This issue was previously discussed in BID 40066 (Adobe Shockwave Player APSB10-12 Multiple Remote Vulnerabilities) but has been given its own record to better document it. These people now have access to some of the best the Web has to offer - including dazzling 3D games and entertainment, interactive product demonstrations, and online learning applications. The vulnerable software fails to sanitize user input when processing .dir files resulting in a crash and overwrite of a few memory registers.<br/><br/> --------------------------------------------------------------------------------<br/><br/><code> (f94.ae4): Access violation - code c0000005 (first chance)<br/> First chance exceptions are reported before any exception handling.<br/> This exception may be expected and handled.<br/> eax=20a0a0a0 ebx=207d004c ecx=00000400 edx=41414140 esi=00000000 edi=a80487d8<br/> eip=68008bd6 esp=0012de4c ebp=00000400 iopl=0 nv up ei pl nz na pe nc<br/> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00050206<br/> *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Director 11\DIRAPI.dll<br/> *** ERROR: Symbol file could not be found. Defaulted to export symbols for DIRAPI.dll - <br/> DIRAPI!Ordinal14+0x3b16:<br/> 68008bd6 2b4f04 sub ecx,dword ptr [edi+4] ds:0023:a80487dc=????????<br/><br/>-----------------------<br/><br/>EAX FFFFFFFF<br/>ECX 41414141<br/>EDX FFFFFFFF<br/>EBX 00000018<br/>ESP 0012F3B4<br/>EBP 02793578<br/>ESI 0012F3C4<br/>EDI 02793578<br/>EIP 69009F1F IML32.69009F1F<br/></code><br/>--------------------------------------------------------------------------------<br/><br/>Tested on: Microsoft Windows XP Professional SP3 (English). ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
1) A boundary error while processing FFFFFF45h Shockwave 3D blocks
can be exploited to corrupt memory.
2) A signedness error in the processing of Director files can be
exploited to corrupt memory.
3) An array indexing error when processing Director files can be
exploited to corrupt memory.
4) An integer overflow error when processing Director files can be
exploited to corrupt memory.
5) An error when processing asset entries contained in Director files
can be exploited to corrupt memory.
6) A boundary error when processing embedded fonts can be exploited
to cause a heap-based buffer overflow via a specially crafted
Director file.
7) An error when processing Director files can be exploited to
overwrite 4 bytes of memory.
8) An error in the implementation of ordinal function 1409 in
iml32.dll can be exploited to corrupt heap memory via a specially
crafted Director file.
9) An error when processing a 4-byte field inside FFFFFF49h Shockwave
3D blocks can be exploited to corrupt heap memory.
10) An unspecified error can be exploited to corrupt memory.
11) A second unspecified error can be exploited to corrupt memory.
12) A third unspecified error can be exploited to corrupt memory.
13) A fourth unspecified error can be exploited to cause a buffer
overflow.
14) A fifth unspecified error can be exploited to corrupt memory.
15) A sixth unspecified error can be exploited to corrupt memory.
16) A seventh unspecified error can be exploited to corrupt memory.
17) An error when processing signed values encountered while parsing
"pami" RIFF chunks can be exploited to corrupt memory.
The vulnerabilities are reported in versions 11.5.6.606 and prior on
Windows and Macintosh.
SOLUTION:
Update to version 11.5.7.609.
http://get.adobe.com/shockwave/
PROVIDED AND/OR DISCOVERED BY:
1-6) Alin Rad Pop, Secunia Research
The vendor also credits:
2) Nahuel Riva of Core Security Technologies.
3) Chaouki Bekrar of Vupen, Code Audit Labs, and an anonymous person
working with iDefense.
7) Chaouki Bekrar and Sebastien Renaud of Vupen, Code Audit Labs,
Gjoko Krstic of Zero Science Lab, and Chro HD of Fortinet's
FortiGuard Labs.
8, 17) an anonymous person working with ZDI.
9) Chaouki Bekrar of Vupen and an anonymous person working with ZDI.
10) Chaouki Bekrar of Vupen.
11-16) Chro HD of Fortinet's FortiGuard Labs.
CHANGELOG:
2010-05-12: Updated "Extended Description" and added PoCs for
vulnerabilities #2, #3, #4, and #6.
ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
Secunia Research:
http://secunia.com/secunia_research/2010-17/
http://secunia.com/secunia_research/2010-19/
http://secunia.com/secunia_research/2010-20/
http://secunia.com/secunia_research/2010-22/
http://secunia.com/secunia_research/2010-34/
http://secunia.com/secunia_research/2010-50/
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-087/
http://www.zerodayinitiative.com/advisories/ZDI-10-088/
http://www.zerodayinitiative.com/advisories/ZDI-10-089/
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=869
Code Audit Labs:
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0137.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0138.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0139.html
Zero Science Lab:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php
Core Security Technologies:
http://www.coresecurity.com/content/adobe-director-invalid-read
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201005-0107 | CVE-2010-1288 | Adobe Shockwave Player Vulnerable to buffer overflow |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Buffer overflow in Adobe Shockwave Player before 11.5.7.609 might allow attackers to execute arbitrary code via unspecified vectors.
Adobe Shockwave Player 11.5.6.606 and prior are vulnerable.
NOTE: This issue was previously discussed in BID 40066 (Adobe Shockwave Player APSB10-12 Multiple Remote Vulnerabilities) but has been given its own record to better document it. These people now have access to some of the best the Web has to offer - including dazzling 3D games and entertainment, interactive product demonstrations, and online learning applications. The vulnerable software fails to sanitize user input when processing .dir files resulting in a crash and overwrite of a few memory registers.<br/><br/> --------------------------------------------------------------------------------<br/><br/><code> (f94.ae4): Access violation - code c0000005 (first chance)<br/> First chance exceptions are reported before any exception handling.<br/> This exception may be expected and handled.<br/> eax=20a0a0a0 ebx=207d004c ecx=00000400 edx=41414140 esi=00000000 edi=a80487d8<br/> eip=68008bd6 esp=0012de4c ebp=00000400 iopl=0 nv up ei pl nz na pe nc<br/> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00050206<br/> *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Director 11\DIRAPI.dll<br/> *** ERROR: Symbol file could not be found. Defaulted to export symbols for DIRAPI.dll - <br/> DIRAPI!Ordinal14+0x3b16:<br/> 68008bd6 2b4f04 sub ecx,dword ptr [edi+4] ds:0023:a80487dc=????????<br/><br/>-----------------------<br/><br/>EAX FFFFFFFF<br/>ECX 41414141<br/>EDX FFFFFFFF<br/>EBX 00000018<br/>ESP 0012F3B4<br/>EBP 02793578<br/>ESI 0012F3C4<br/>EDI 02793578<br/>EIP 69009F1F IML32.69009F1F<br/></code><br/>--------------------------------------------------------------------------------<br/><br/>Tested on: Microsoft Windows XP Professional SP3 (English). ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
1) A boundary error while processing FFFFFF45h Shockwave 3D blocks
can be exploited to corrupt memory.
2) A signedness error in the processing of Director files can be
exploited to corrupt memory.
3) An array indexing error when processing Director files can be
exploited to corrupt memory.
4) An integer overflow error when processing Director files can be
exploited to corrupt memory.
5) An error when processing asset entries contained in Director files
can be exploited to corrupt memory.
6) A boundary error when processing embedded fonts can be exploited
to cause a heap-based buffer overflow via a specially crafted
Director file.
7) An error when processing Director files can be exploited to
overwrite 4 bytes of memory.
8) An error in the implementation of ordinal function 1409 in
iml32.dll can be exploited to corrupt heap memory via a specially
crafted Director file.
9) An error when processing a 4-byte field inside FFFFFF49h Shockwave
3D blocks can be exploited to corrupt heap memory.
10) An unspecified error can be exploited to corrupt memory.
11) A second unspecified error can be exploited to corrupt memory.
12) A third unspecified error can be exploited to corrupt memory.
13) A fourth unspecified error can be exploited to cause a buffer
overflow.
14) A fifth unspecified error can be exploited to corrupt memory.
15) A sixth unspecified error can be exploited to corrupt memory.
16) A seventh unspecified error can be exploited to corrupt memory.
17) An error when processing signed values encountered while parsing
"pami" RIFF chunks can be exploited to corrupt memory.
Successful exploitation of the vulnerabilities may allow execution of
arbitrary code.
The vulnerabilities are reported in versions 11.5.6.606 and prior on
Windows and Macintosh.
SOLUTION:
Update to version 11.5.7.609.
http://get.adobe.com/shockwave/
PROVIDED AND/OR DISCOVERED BY:
1-6) Alin Rad Pop, Secunia Research
The vendor also credits:
2) Nahuel Riva of Core Security Technologies.
3) Chaouki Bekrar of Vupen, Code Audit Labs, and an anonymous person
working with iDefense.
7) Chaouki Bekrar and Sebastien Renaud of Vupen, Code Audit Labs,
Gjoko Krstic of Zero Science Lab, and Chro HD of Fortinet's
FortiGuard Labs.
8, 17) an anonymous person working with ZDI.
9) Chaouki Bekrar of Vupen and an anonymous person working with ZDI.
10) Chaouki Bekrar of Vupen.
11-16) Chro HD of Fortinet's FortiGuard Labs.
CHANGELOG:
2010-05-12: Updated "Extended Description" and added PoCs for
vulnerabilities #2, #3, #4, and #6.
ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
Secunia Research:
http://secunia.com/secunia_research/2010-17/
http://secunia.com/secunia_research/2010-19/
http://secunia.com/secunia_research/2010-20/
http://secunia.com/secunia_research/2010-22/
http://secunia.com/secunia_research/2010-34/
http://secunia.com/secunia_research/2010-50/
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-087/
http://www.zerodayinitiative.com/advisories/ZDI-10-088/
http://www.zerodayinitiative.com/advisories/ZDI-10-089/
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=869
Code Audit Labs:
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0137.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0138.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0139.html
Zero Science Lab:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php
Core Security Technologies:
http://www.coresecurity.com/content/adobe-director-invalid-read
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201005-0111 | CVE-2010-1292 | Adobe Shockwave Player of pami RIFF chunk Arbitrary code execution vulnerability in parsing |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
The implementation of pami RIFF chunk parsing in Adobe Shockwave Player before 11.5.7.609 does not validate a certain value from a file before using it in file-pointer calculations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Shockwave. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the code responsible for parsing Director files. When the application parses the pami RIFF chunk, it trusts an offset value and seeks into the file data. If provided with signed values in the data at the given offset, the process can be made to incorrectly calculate a pointer and operate on the data at it's location. This can be abused by an attacker to execute arbitrary code under the context of the user running the browser.
Adobe Shockwave Player 11.5.6.606 and prior are vulnerable.
NOTE: This issue was previously discussed in BID 40066 (Adobe Shockwave Player APSB10-12 Multiple Remote Vulnerabilities) but has been given its own record to better document it. These people now have access to some of the best the Web has to offer - including dazzling 3D games and entertainment, interactive product demonstrations, and online learning applications. The vulnerable software fails to sanitize user input when processing .dir files resulting in a crash and overwrite of a few memory registers.<br/><br/> --------------------------------------------------------------------------------<br/><br/><code> (f94.ae4): Access violation - code c0000005 (first chance)<br/> First chance exceptions are reported before any exception handling.<br/> This exception may be expected and handled.<br/> eax=20a0a0a0 ebx=207d004c ecx=00000400 edx=41414140 esi=00000000 edi=a80487d8<br/> eip=68008bd6 esp=0012de4c ebp=00000400 iopl=0 nv up ei pl nz na pe nc<br/> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00050206<br/> *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Director 11\DIRAPI.dll<br/> *** ERROR: Symbol file could not be found. Defaulted to export symbols for DIRAPI.dll - <br/> DIRAPI!Ordinal14+0x3b16:<br/> 68008bd6 2b4f04 sub ecx,dword ptr [edi+4] ds:0023:a80487dc=????????<br/><br/>-----------------------<br/><br/>EAX FFFFFFFF<br/>ECX 41414141<br/>EDX FFFFFFFF<br/>EBX 00000018<br/>ESP 0012F3B4<br/>EBP 02793578<br/>ESI 0012F3C4<br/>EDI 02793578<br/>EIP 69009F1F IML32.69009F1F<br/></code><br/>--------------------------------------------------------------------------------<br/><br/>Tested on: Microsoft Windows XP Professional SP3 (English). ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
1) A boundary error while processing FFFFFF45h Shockwave 3D blocks
can be exploited to corrupt memory.
2) A signedness error in the processing of Director files can be
exploited to corrupt memory.
3) An array indexing error when processing Director files can be
exploited to corrupt memory.
4) An integer overflow error when processing Director files can be
exploited to corrupt memory.
5) An error when processing asset entries contained in Director files
can be exploited to corrupt memory.
6) A boundary error when processing embedded fonts can be exploited
to cause a heap-based buffer overflow via a specially crafted
Director file.
7) An error when processing Director files can be exploited to
overwrite 4 bytes of memory.
8) An error in the implementation of ordinal function 1409 in
iml32.dll can be exploited to corrupt heap memory via a specially
crafted Director file.
9) An error when processing a 4-byte field inside FFFFFF49h Shockwave
3D blocks can be exploited to corrupt heap memory.
10) An unspecified error can be exploited to corrupt memory.
11) A second unspecified error can be exploited to corrupt memory.
12) A third unspecified error can be exploited to corrupt memory.
13) A fourth unspecified error can be exploited to cause a buffer
overflow.
14) A fifth unspecified error can be exploited to corrupt memory.
15) A sixth unspecified error can be exploited to corrupt memory.
16) A seventh unspecified error can be exploited to corrupt memory.
17) An error when processing signed values encountered while parsing
"pami" RIFF chunks can be exploited to corrupt memory.
Successful exploitation of the vulnerabilities may allow execution of
arbitrary code.
The vulnerabilities are reported in versions 11.5.6.606 and prior on
Windows and Macintosh.
SOLUTION:
Update to version 11.5.7.609.
http://get.adobe.com/shockwave/
PROVIDED AND/OR DISCOVERED BY:
1-6) Alin Rad Pop, Secunia Research
The vendor also credits:
2) Nahuel Riva of Core Security Technologies.
3) Chaouki Bekrar of Vupen, Code Audit Labs, and an anonymous person
working with iDefense.
7) Chaouki Bekrar and Sebastien Renaud of Vupen, Code Audit Labs,
Gjoko Krstic of Zero Science Lab, and Chro HD of Fortinet's
FortiGuard Labs.
8, 17) an anonymous person working with ZDI.
9) Chaouki Bekrar of Vupen and an anonymous person working with ZDI.
10) Chaouki Bekrar of Vupen.
11-16) Chro HD of Fortinet's FortiGuard Labs.
CHANGELOG:
2010-05-12: Updated "Extended Description" and added PoCs for
vulnerabilities #2, #3, #4, and #6.
ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
Secunia Research:
http://secunia.com/secunia_research/2010-17/
http://secunia.com/secunia_research/2010-19/
http://secunia.com/secunia_research/2010-20/
http://secunia.com/secunia_research/2010-22/
http://secunia.com/secunia_research/2010-34/
http://secunia.com/secunia_research/2010-50/
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-087/
http://www.zerodayinitiative.com/advisories/ZDI-10-088/
http://www.zerodayinitiative.com/advisories/ZDI-10-089/
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=869
Code Audit Labs:
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0137.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0138.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0139.html
Zero Science Lab:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php
Core Security Technologies:
http://www.coresecurity.com/content/adobe-director-invalid-read
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
.
-- Vendor Response:
Adobe has issued an update to correct this vulnerability. More
details can be found at:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
-- Disclosure Timeline:
2010-04-08 - Vulnerability reported to vendor
2010-05-11 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* Anonymous
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
| VAR-201005-0104 | CVE-2010-1284 | Adobe Shockwave Player Vulnerable to arbitrary code execution |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Adobe Shockwave Player before 11.5.7.609 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-1286, CVE-2010-1287, CVE-2010-1289, CVE-2010-1290, and CVE-2010-1291. Adobe Shockwave Player is prone to multiple remote code-execution vulnerabilities. Failed exploit attempts may cause a denial-of-service condition.
Versions prior to Shockwave Player 11.5.7.609 are vulnerable.
NOTE: These issues were previously covered in BID 40066 (Adobe Shockwave Player APSB10-12 Multiple Remote Vulnerabilities); they have been given their own record to better document them. The vulnerable software fails to sanitize user input when processing .dir files resulting in a crash and overwrite of a few memory registers.<br/><br/> --------------------------------------------------------------------------------<br/><br/><code> (f94.ae4): Access violation - code c0000005 (first chance)<br/> First chance exceptions are reported before any exception handling.<br/> This exception may be expected and handled.<br/> eax=20a0a0a0 ebx=207d004c ecx=00000400 edx=41414140 esi=00000000 edi=a80487d8<br/> eip=68008bd6 esp=0012de4c ebp=00000400 iopl=0 nv up ei pl nz na pe nc<br/> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00050206<br/> *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Director 11\DIRAPI.dll<br/> *** ERROR: Symbol file could not be found. Defaulted to export symbols for DIRAPI.dll - <br/> DIRAPI!Ordinal14+0x3b16:<br/> 68008bd6 2b4f04 sub ecx,dword ptr [edi+4] ds:0023:a80487dc=????????<br/><br/>-----------------------<br/><br/>EAX FFFFFFFF<br/>ECX 41414141<br/>EDX FFFFFFFF<br/>EBX 00000018<br/>ESP 0012F3B4<br/>EBP 02793578<br/>ESI 0012F3C4<br/>EDI 02793578<br/>EIP 69009F1F IML32.69009F1F<br/></code><br/>--------------------------------------------------------------------------------<br/><br/>Tested on: Microsoft Windows XP Professional SP3 (English). ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
1) A boundary error while processing FFFFFF45h Shockwave 3D blocks
can be exploited to corrupt memory.
2) A signedness error in the processing of Director files can be
exploited to corrupt memory.
3) An array indexing error when processing Director files can be
exploited to corrupt memory.
4) An integer overflow error when processing Director files can be
exploited to corrupt memory.
5) An error when processing asset entries contained in Director files
can be exploited to corrupt memory.
6) A boundary error when processing embedded fonts can be exploited
to cause a heap-based buffer overflow via a specially crafted
Director file.
7) An error when processing Director files can be exploited to
overwrite 4 bytes of memory.
8) An error in the implementation of ordinal function 1409 in
iml32.dll can be exploited to corrupt heap memory via a specially
crafted Director file.
9) An error when processing a 4-byte field inside FFFFFF49h Shockwave
3D blocks can be exploited to corrupt heap memory.
10) An unspecified error can be exploited to corrupt memory.
11) A second unspecified error can be exploited to corrupt memory.
12) A third unspecified error can be exploited to corrupt memory.
13) A fourth unspecified error can be exploited to cause a buffer
overflow.
14) A fifth unspecified error can be exploited to corrupt memory.
15) A sixth unspecified error can be exploited to corrupt memory.
16) A seventh unspecified error can be exploited to corrupt memory.
17) An error when processing signed values encountered while parsing
"pami" RIFF chunks can be exploited to corrupt memory.
SOLUTION:
Update to version 11.5.7.609.
http://get.adobe.com/shockwave/
PROVIDED AND/OR DISCOVERED BY:
1-6) Alin Rad Pop, Secunia Research
The vendor also credits:
2) Nahuel Riva of Core Security Technologies.
3) Chaouki Bekrar of Vupen, Code Audit Labs, and an anonymous person
working with iDefense.
7) Chaouki Bekrar and Sebastien Renaud of Vupen, Code Audit Labs,
Gjoko Krstic of Zero Science Lab, and Chro HD of Fortinet's
FortiGuard Labs.
8, 17) an anonymous person working with ZDI.
9) Chaouki Bekrar of Vupen and an anonymous person working with ZDI.
10) Chaouki Bekrar of Vupen.
11-16) Chro HD of Fortinet's FortiGuard Labs.
CHANGELOG:
2010-05-12: Updated "Extended Description" and added PoCs for
vulnerabilities #2, #3, #4, and #6.
ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
Secunia Research:
http://secunia.com/secunia_research/2010-17/
http://secunia.com/secunia_research/2010-19/
http://secunia.com/secunia_research/2010-20/
http://secunia.com/secunia_research/2010-22/
http://secunia.com/secunia_research/2010-34/
http://secunia.com/secunia_research/2010-50/
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-087/
http://www.zerodayinitiative.com/advisories/ZDI-10-088/
http://www.zerodayinitiative.com/advisories/ZDI-10-089/
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=869
Code Audit Labs:
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0137.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0138.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0139.html
Zero Science Lab:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php
Core Security Technologies:
http://www.coresecurity.com/content/adobe-director-invalid-read
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. These people now have access to some of the best the Web has to
offer
including dazzling 3D games and entertainment, interactive product
demonstrations, and online learning applications. Shockwave Player displays
Web content that has been created by Adobe Director." from Adobe.com
II.
III. Binary Analysis & Proof-of-concept
---------------------------------------
In-depth binary analysis, code execution exploits and proof-of-concept
codes are published through the VUPEN Binary Analysis & Exploits Service :
http://www.vupen.com/exploits/
V. CREDIT
--------------
These vulnerabilities were discovered by Chaouki Bekrar of VUPEN Security
VII. ABOUT VUPEN Security
---------------------------
VUPEN is a leading IT security research company providing vulnerability
management and security intelligence solutions which enable enterprises
and institutions to eliminate vulnerabilities before they can be exploited,
ensure security policy compliance and meaningfully measure and manage risks.
Governmental and federal agencies, and global enterprises in the financial
services, insurance, manufacturing and technology industries rely on VUPEN
to improve their security, prioritize resources, cut time and costs, and
stay ahead of the latest threats.
* VUPEN Vulnerability Notification Service:
http://www.vupen.com/english/services/
* VUPEN Binary Analysis & Exploits Service :
http://www.vupen.com/exploits/
* VUPEN Web Application Security Scanner (WASS):
http://www.vupen.com/english/wass/
VIII. REFERENCES
----------------------
http://www.vupen.com/english/advisories/2010/1128
http://www.adobe.com/support/security/bulletins/apsb10-12.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1284
IX. DISCLOSURE TIMELINE
-----------------------------
2010-02-24 - Vendor notified
2010-02-24 - Vendor response
2010-03-02 - Status update received
2010-05-07 - Status update received
2010-05-12 - Coordinated public Disclosure
| VAR-201005-0102 | CVE-2010-1282 | Adobe Shockwave Player Service disruption in (DoS) Vulnerabilities |
CVSS V2: 4.3 CVSS V3: 6.5 Severity: MEDIUM |
Adobe Shockwave Player before 11.5.7.609 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted ATOM size in a .dir (aka Director) file. Adobe Shockwave Player is prone to a denial-of-service vulnerability.
Attackers can exploit this issue to cause the affected application to consume excessive resources, resulting in a denial-of-service condition.
Adobe Shockwave Player 11.5.6.606 and prior are vulnerable.
NOTE: This issue was previously discussed in BID 40066 (Adobe Shockwave Player APSB10-12 Multiple Remote Vulnerabilities) but has been given its own record to better document it. These people now have access to some of the best the Web has to offer - including dazzling 3D games and entertainment, interactive product demonstrations, and online learning applications. Shockwave Player displays Web content that has been created by Adobe Director.Shockwave Player version 11.5.6.606 and earlier from Adobe suffers from a memory consumption / corruption and buffer overflow vulnerabilities that can aid the attacker to cause denial of service scenarios and arbitrary code execution. The vulnerable software fails to sanitize user input when processing .dir files resulting in a crash and overwrite of a few memory registers.<br/><br/> --------------------------------------------------------------------------------<br/><br/><code> (f94.ae4): Access violation - code c0000005 (first chance)<br/> First chance exceptions are reported before any exception handling.<br/> This exception may be expected and handled.<br/> eax=20a0a0a0 ebx=207d004c ecx=00000400 edx=41414140 esi=00000000 edi=a80487d8<br/> eip=68008bd6 esp=0012de4c ebp=00000400 iopl=0 nv up ei pl nz na pe nc<br/> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00050206<br/> *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Director 11\DIRAPI.dll<br/> *** ERROR: Symbol file could not be found. Defaulted to export symbols for DIRAPI.dll - <br/> DIRAPI!Ordinal14+0x3b16:<br/> 68008bd6 2b4f04 sub ecx,dword ptr [edi+4] ds:0023:a80487dc=????????<br/><br/>-----------------------<br/><br/>EAX FFFFFFFF<br/>ECX 41414141<br/>EDX FFFFFFFF<br/>EBX 00000018<br/>ESP 0012F3B4<br/>EBP 02793578<br/>ESI 0012F3C4<br/>EDI 02793578<br/>EIP 69009F1F IML32.69009F1F<br/></code><br/>--------------------------------------------------------------------------------<br/><br/>Tested on: Microsoft Windows XP Professional SP3 (English). ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
1) A boundary error while processing FFFFFF45h Shockwave 3D blocks
can be exploited to corrupt memory.
2) A signedness error in the processing of Director files can be
exploited to corrupt memory.
3) An array indexing error when processing Director files can be
exploited to corrupt memory.
4) An integer overflow error when processing Director files can be
exploited to corrupt memory.
5) An error when processing asset entries contained in Director files
can be exploited to corrupt memory.
6) A boundary error when processing embedded fonts can be exploited
to cause a heap-based buffer overflow via a specially crafted
Director file.
7) An error when processing Director files can be exploited to
overwrite 4 bytes of memory.
8) An error in the implementation of ordinal function 1409 in
iml32.dll can be exploited to corrupt heap memory via a specially
crafted Director file.
9) An error when processing a 4-byte field inside FFFFFF49h Shockwave
3D blocks can be exploited to corrupt heap memory.
10) An unspecified error can be exploited to corrupt memory.
11) A second unspecified error can be exploited to corrupt memory.
12) A third unspecified error can be exploited to corrupt memory.
13) A fourth unspecified error can be exploited to cause a buffer
overflow.
14) A fifth unspecified error can be exploited to corrupt memory.
15) A sixth unspecified error can be exploited to corrupt memory.
16) A seventh unspecified error can be exploited to corrupt memory.
17) An error when processing signed values encountered while parsing
"pami" RIFF chunks can be exploited to corrupt memory.
Successful exploitation of the vulnerabilities may allow execution of
arbitrary code.
The vulnerabilities are reported in versions 11.5.6.606 and prior on
Windows and Macintosh.
SOLUTION:
Update to version 11.5.7.609.
http://get.adobe.com/shockwave/
PROVIDED AND/OR DISCOVERED BY:
1-6) Alin Rad Pop, Secunia Research
The vendor also credits:
2) Nahuel Riva of Core Security Technologies.
3) Chaouki Bekrar of Vupen, Code Audit Labs, and an anonymous person
working with iDefense.
7) Chaouki Bekrar and Sebastien Renaud of Vupen, Code Audit Labs,
Gjoko Krstic of Zero Science Lab, and Chro HD of Fortinet's
FortiGuard Labs.
8, 17) an anonymous person working with ZDI.
9) Chaouki Bekrar of Vupen and an anonymous person working with ZDI.
10) Chaouki Bekrar of Vupen.
11-16) Chro HD of Fortinet's FortiGuard Labs.
CHANGELOG:
2010-05-12: Updated "Extended Description" and added PoCs for
vulnerabilities #2, #3, #4, and #6.
ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
Secunia Research:
http://secunia.com/secunia_research/2010-17/
http://secunia.com/secunia_research/2010-19/
http://secunia.com/secunia_research/2010-20/
http://secunia.com/secunia_research/2010-22/
http://secunia.com/secunia_research/2010-34/
http://secunia.com/secunia_research/2010-50/
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-087/
http://www.zerodayinitiative.com/advisories/ZDI-10-088/
http://www.zerodayinitiative.com/advisories/ZDI-10-089/
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=869
Code Audit Labs:
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0137.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0138.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0139.html
Zero Science Lab:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php
Core Security Technologies:
http://www.coresecurity.com/content/adobe-director-invalid-read
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. User
interaction is required in that a user must visit a malicious web site.
Exploitation can lead to remote system high cpu load ( infinite loop).
ref
http://hi.baidu.com/fs_fx/blog/item/f8de1d18ba8c9b76dbb4bd56.html
http://www.adobe.com/support/security/bulletins/apsb10-12.html
Disclosure Timeline
===================
2010-2-6 report to vendor
2010-2-7 vendor ask poc file
2010-2-7 we sent the poc file.
2010-2-8 vendor comfirm the issue.
2010-5-11 Coordinated public release of advisory.
About Code Audit Labs:
=====================
Code Audit Labs is department of VulnHunt company which provide a
professional security testing products / services / security consulting
and training ,we sincerely hope we can help your procudes to improve code
quality and safety.
WebSite http://www.VulnHunt.com ( online soon)
| VAR-201005-0084 | CVE-2010-0986 | Adobe Shockwave Player Vulnerable to arbitrary code execution |
CVSS V2: 9.3 CVSS V3: 8.8 Severity: HIGH |
Adobe Shockwave Player before 11.5.7.609 does not properly process asset entries, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted Shockwave file. Adobe Shockwave Player is prone to a remote code-execution vulnerability.
Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
Adobe Shockwave Player 11.5.6.606 and prior are vulnerable.
NOTE: This issue was previously discussed in BID 40066 (Adobe Shockwave Player APSB10-12 Multiple Remote Vulnerabilities) but has been given its own record to better document it. The vulnerable software fails to sanitize user input when processing .dir files resulting in a crash and overwrite of a few memory registers.<br/><br/> --------------------------------------------------------------------------------<br/><br/><code> (f94.ae4): Access violation - code c0000005 (first chance)<br/> First chance exceptions are reported before any exception handling.<br/> This exception may be expected and handled.<br/> eax=20a0a0a0 ebx=207d004c ecx=00000400 edx=41414140 esi=00000000 edi=a80487d8<br/> eip=68008bd6 esp=0012de4c ebp=00000400 iopl=0 nv up ei pl nz na pe nc<br/> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00050206<br/> *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Director 11\DIRAPI.dll<br/> *** ERROR: Symbol file could not be found. Defaulted to export symbols for DIRAPI.dll - <br/> DIRAPI!Ordinal14+0x3b16:<br/> 68008bd6 2b4f04 sub ecx,dword ptr [edi+4] ds:0023:a80487dc=????????<br/><br/>-----------------------<br/><br/>EAX FFFFFFFF<br/>ECX 41414141<br/>EDX FFFFFFFF<br/>EBX 00000018<br/>ESP 0012F3B4<br/>EBP 02793578<br/>ESI 0012F3C4<br/>EDI 02793578<br/>EIP 69009F1F IML32.69009F1F<br/></code><br/>--------------------------------------------------------------------------------<br/><br/>Tested on: Microsoft Windows XP Professional SP3 (English). ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
1) A boundary error while processing FFFFFF45h Shockwave 3D blocks
can be exploited to corrupt memory.
2) A signedness error in the processing of Director files can be
exploited to corrupt memory.
3) An array indexing error when processing Director files can be
exploited to corrupt memory.
4) An integer overflow error when processing Director files can be
exploited to corrupt memory.
5) An error when processing asset entries contained in Director files
can be exploited to corrupt memory.
6) A boundary error when processing embedded fonts can be exploited
to cause a heap-based buffer overflow via a specially crafted
Director file.
7) An error when processing Director files can be exploited to
overwrite 4 bytes of memory.
8) An error in the implementation of ordinal function 1409 in
iml32.dll can be exploited to corrupt heap memory via a specially
crafted Director file.
9) An error when processing a 4-byte field inside FFFFFF49h Shockwave
3D blocks can be exploited to corrupt heap memory.
10) An unspecified error can be exploited to corrupt memory.
11) A second unspecified error can be exploited to corrupt memory.
12) A third unspecified error can be exploited to corrupt memory.
13) A fourth unspecified error can be exploited to cause a buffer
overflow.
14) A fifth unspecified error can be exploited to corrupt memory.
15) A sixth unspecified error can be exploited to corrupt memory.
16) A seventh unspecified error can be exploited to corrupt memory.
17) An error when processing signed values encountered while parsing
"pami" RIFF chunks can be exploited to corrupt memory.
Successful exploitation of the vulnerabilities may allow execution of
arbitrary code.
The vulnerabilities are reported in versions 11.5.6.606 and prior on
Windows and Macintosh.
SOLUTION:
Update to version 11.5.7.609.
http://get.adobe.com/shockwave/
PROVIDED AND/OR DISCOVERED BY:
1-6) Alin Rad Pop, Secunia Research
The vendor also credits:
2) Nahuel Riva of Core Security Technologies.
3) Chaouki Bekrar of Vupen, Code Audit Labs, and an anonymous person
working with iDefense.
7) Chaouki Bekrar and Sebastien Renaud of Vupen, Code Audit Labs,
Gjoko Krstic of Zero Science Lab, and Chro HD of Fortinet's
FortiGuard Labs.
8, 17) an anonymous person working with ZDI.
9) Chaouki Bekrar of Vupen and an anonymous person working with ZDI.
10) Chaouki Bekrar of Vupen.
11-16) Chro HD of Fortinet's FortiGuard Labs.
CHANGELOG:
2010-05-12: Updated "Extended Description" and added PoCs for
vulnerabilities #2, #3, #4, and #6.
ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
Secunia Research:
http://secunia.com/secunia_research/2010-17/
http://secunia.com/secunia_research/2010-19/
http://secunia.com/secunia_research/2010-20/
http://secunia.com/secunia_research/2010-22/
http://secunia.com/secunia_research/2010-34/
http://secunia.com/secunia_research/2010-50/
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-087/
http://www.zerodayinitiative.com/advisories/ZDI-10-088/
http://www.zerodayinitiative.com/advisories/ZDI-10-089/
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=869
Code Audit Labs:
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0137.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0138.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0139.html
Zero Science Lab:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php
Core Security Technologies:
http://www.coresecurity.com/content/adobe-director-invalid-read
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
.
======================================================================
2) Severity
Rating: Highly critical
Impact: System access
Where: From remote
======================================================================
3) Vendor's Description of Software
"Over 450 million Internet-enabled desktops have installed Adobe
Shockwave Player.
======================================================================
6) Time Table
17/03/2010 - Vendor notified.
17/03/2010 - Vendor response.
12/05/2010 - Public disclosure.
======================================================================
8) References
The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2010-0986 for the vulnerability.
======================================================================
9) About Secunia
Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:
http://secunia.com/advisories/business_solutions/
Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.
http://secunia.com/advisories/
Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:
http://secunia.com/secunia_research/
Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:
http://secunia.com/corporate/jobs/
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/advisories/mailing_lists/
======================================================================
10) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2010-34/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
| VAR-201005-0103 | CVE-2010-1283 | Adobe Shockwave Player Vulnerable to arbitrary code execution |
CVSS V2: 9.3 CVSS V3: 8.8 Severity: HIGH |
Adobe Shockwave Player before 11.5.7.609 does not properly parse 3D objects in .dir (aka Director) files, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a modified field in a 0xFFFFFF49 record. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Shockwave. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.The specific flaw exists within the code responsible for parsing 3D objects defined inside Director files. These files are essentially RIFF-based, but stored in big endian format. An undocumented 4-byte field within record type 0xFFFFFF49 can be modified to cause corruption of heap memory. This corruption can be used to modify function pointers and achieve remote code execution under the context of the user running the browser. Adobe Shockwave Player is prone to a memory-corruption vulnerability.
Adobe Shockwave Player 11.5.6.606 and prior are vulnerable.
NOTE: This issue was previously discussed in BID 40066 (Adobe Shockwave Player APSB10-12 Multiple Remote Vulnerabilities) but has been given its own record to better document it. The vulnerable software fails to sanitize user input when processing .dir files resulting in a crash and overwrite of a few memory registers.<br/><br/> --------------------------------------------------------------------------------<br/><br/><code> (f94.ae4): Access violation - code c0000005 (first chance)<br/> First chance exceptions are reported before any exception handling.<br/> This exception may be expected and handled.<br/> eax=20a0a0a0 ebx=207d004c ecx=00000400 edx=41414140 esi=00000000 edi=a80487d8<br/> eip=68008bd6 esp=0012de4c ebp=00000400 iopl=0 nv up ei pl nz na pe nc<br/> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00050206<br/> *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Director 11\DIRAPI.dll<br/> *** ERROR: Symbol file could not be found. Defaulted to export symbols for DIRAPI.dll - <br/> DIRAPI!Ordinal14+0x3b16:<br/> 68008bd6 2b4f04 sub ecx,dword ptr [edi+4] ds:0023:a80487dc=????????<br/><br/>-----------------------<br/><br/>EAX FFFFFFFF<br/>ECX 41414141<br/>EDX FFFFFFFF<br/>EBX 00000018<br/>ESP 0012F3B4<br/>EBP 02793578<br/>ESI 0012F3C4<br/>EDI 02793578<br/>EIP 69009F1F IML32.69009F1F<br/></code><br/>--------------------------------------------------------------------------------<br/><br/>Tested on: Microsoft Windows XP Professional SP3 (English). More
details can be found at:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
-- Disclosure Timeline:
2010-03-12 - Vulnerability reported to vendor
2010-05-11 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* Anonymous
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
. ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
1) A boundary error while processing FFFFFF45h Shockwave 3D blocks
can be exploited to corrupt memory.
2) A signedness error in the processing of Director files can be
exploited to corrupt memory.
3) An array indexing error when processing Director files can be
exploited to corrupt memory.
4) An integer overflow error when processing Director files can be
exploited to corrupt memory.
5) An error when processing asset entries contained in Director files
can be exploited to corrupt memory.
6) A boundary error when processing embedded fonts can be exploited
to cause a heap-based buffer overflow via a specially crafted
Director file.
7) An error when processing Director files can be exploited to
overwrite 4 bytes of memory.
8) An error in the implementation of ordinal function 1409 in
iml32.dll can be exploited to corrupt heap memory via a specially
crafted Director file.
10) An unspecified error can be exploited to corrupt memory.
11) A second unspecified error can be exploited to corrupt memory.
12) A third unspecified error can be exploited to corrupt memory.
13) A fourth unspecified error can be exploited to cause a buffer
overflow.
14) A fifth unspecified error can be exploited to corrupt memory.
15) A sixth unspecified error can be exploited to corrupt memory.
16) A seventh unspecified error can be exploited to corrupt memory.
17) An error when processing signed values encountered while parsing
"pami" RIFF chunks can be exploited to corrupt memory.
Successful exploitation of the vulnerabilities may allow execution of
arbitrary code.
The vulnerabilities are reported in versions 11.5.6.606 and prior on
Windows and Macintosh.
SOLUTION:
Update to version 11.5.7.609.
http://get.adobe.com/shockwave/
PROVIDED AND/OR DISCOVERED BY:
1-6) Alin Rad Pop, Secunia Research
The vendor also credits:
2) Nahuel Riva of Core Security Technologies.
3) Chaouki Bekrar of Vupen, Code Audit Labs, and an anonymous person
working with iDefense.
7) Chaouki Bekrar and Sebastien Renaud of Vupen, Code Audit Labs,
Gjoko Krstic of Zero Science Lab, and Chro HD of Fortinet's
FortiGuard Labs.
8, 17) an anonymous person working with ZDI.
9) Chaouki Bekrar of Vupen and an anonymous person working with ZDI.
10) Chaouki Bekrar of Vupen.
11-16) Chro HD of Fortinet's FortiGuard Labs.
CHANGELOG:
2010-05-12: Updated "Extended Description" and added PoCs for
vulnerabilities #2, #3, #4, and #6.
ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
Secunia Research:
http://secunia.com/secunia_research/2010-17/
http://secunia.com/secunia_research/2010-19/
http://secunia.com/secunia_research/2010-20/
http://secunia.com/secunia_research/2010-22/
http://secunia.com/secunia_research/2010-34/
http://secunia.com/secunia_research/2010-50/
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-087/
http://www.zerodayinitiative.com/advisories/ZDI-10-088/
http://www.zerodayinitiative.com/advisories/ZDI-10-089/
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=869
Code Audit Labs:
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0137.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0138.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0139.html
Zero Science Lab:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php
Core Security Technologies:
http://www.coresecurity.com/content/adobe-director-invalid-read
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
. These people now have access to some of the best the Web has to
offer
including dazzling 3D games and entertainment, interactive product
demonstrations, and online learning applications. Shockwave Player displays
Web content that has been created by Adobe Director." from Adobe.com
II.
III. Binary Analysis & Proof-of-concept
---------------------------------------
In-depth binary analysis, code execution exploits and proof-of-concept
codes are published through the VUPEN Binary Analysis & Exploits Service :
http://www.vupen.com/exploits/
V. CREDIT
--------------
This vulnerability was discovered by Chaouki Bekrar of VUPEN Security
VII. ABOUT VUPEN Security
---------------------------
VUPEN is a leading IT security research company providing vulnerability
management and security intelligence solutions which enable enterprises
and institutions to eliminate vulnerabilities before they can be exploited,
ensure security policy compliance and meaningfully measure and manage risks.
Governmental and federal agencies, and global enterprises in the financial
services, insurance, manufacturing and technology industries rely on VUPEN
to improve their security, prioritize resources, cut time and costs, and
stay ahead of the latest threats.
* VUPEN Vulnerability Notification Service:
http://www.vupen.com/english/services/
* VUPEN Binary Analysis & Exploits Service :
http://www.vupen.com/exploits/
* VUPEN Web Application Security Scanner (WASS):
http://www.vupen.com/english/wass/
VIII. REFERENCES
----------------------
http://www.vupen.com/english/advisories/2010/1128
http://www.adobe.com/support/security/bulletins/apsb10-12.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1283
IX. DISCLOSURE TIMELINE
-----------------------------
2010-02-24 - Vendor notified
2010-02-24 - Vendor response
2010-03-02 - Status update received
2010-05-07 - Status update received
2010-05-12 - Coordinated public Disclosure
| VAR-201005-0085 | CVE-2010-0987 | Adobe Shockwave Player Heap-based buffer overflow vulnerability |
CVSS V2: 9.3 CVSS V3: 8.8 Severity: HIGH |
Heap-based buffer overflow in Adobe Shockwave Player before 11.5.7.609 might allow remote attackers to execute arbitrary code via crafted embedded fonts in a Shockwave file. Adobe Shockwave Player is prone to a buffer-overflow vulnerability.
Attackers can exploit this issue to crash the affected application and execute arbitrary code within the context of the affected application.
Adobe Shockwave Player 11.5.6.606 and prior are vulnerable.
NOTE: This issue was previously discussed in BID 40066 (Adobe Shockwave Player APSB10-12 Multiple Remote Vulnerabilities) but has been given its own record to better document it. The vulnerable software fails to sanitize user input when processing .dir files resulting in a crash and overwrite of a few memory registers.<br/><br/> --------------------------------------------------------------------------------<br/><br/><code> (f94.ae4): Access violation - code c0000005 (first chance)<br/> First chance exceptions are reported before any exception handling.<br/> This exception may be expected and handled.<br/> eax=20a0a0a0 ebx=207d004c ecx=00000400 edx=41414140 esi=00000000 edi=a80487d8<br/> eip=68008bd6 esp=0012de4c ebp=00000400 iopl=0 nv up ei pl nz na pe nc<br/> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00050206<br/> *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Director 11\DIRAPI.dll<br/> *** ERROR: Symbol file could not be found. Defaulted to export symbols for DIRAPI.dll - <br/> DIRAPI!Ordinal14+0x3b16:<br/> 68008bd6 2b4f04 sub ecx,dword ptr [edi+4] ds:0023:a80487dc=????????<br/><br/>-----------------------<br/><br/>EAX FFFFFFFF<br/>ECX 41414141<br/>EDX FFFFFFFF<br/>EBX 00000018<br/>ESP 0012F3B4<br/>EBP 02793578<br/>ESI 0012F3C4<br/>EDI 02793578<br/>EIP 69009F1F IML32.69009F1F<br/></code><br/>--------------------------------------------------------------------------------<br/><br/>Tested on: Microsoft Windows XP Professional SP3 (English).
======================================================================
2) Severity
Rating: Highly critical
Impact: System access
Where: From remote
======================================================================
3) Vendor's Description of Software
"Over 450 million Internet-enabled desktops have installed Adobe
Shockwave Player.
======================================================================
6) Time Table
23/03/2010 - Vendor notified.
23/03/2010 - Vendor response.
12/05/2010 - Public disclosure.
======================================================================
8) References
The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2010-0987 for the vulnerability.
======================================================================
9) About Secunia
Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:
http://secunia.com/advisories/business_solutions/
Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.
http://secunia.com/advisories/
Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:
http://secunia.com/secunia_research/
Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:
http://secunia.com/corporate/jobs/
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/advisories/mailing_lists/
======================================================================
10) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2010-50/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
. ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
1) A boundary error while processing FFFFFF45h Shockwave 3D blocks
can be exploited to corrupt memory.
2) A signedness error in the processing of Director files can be
exploited to corrupt memory.
3) An array indexing error when processing Director files can be
exploited to corrupt memory.
4) An integer overflow error when processing Director files can be
exploited to corrupt memory.
5) An error when processing asset entries contained in Director files
can be exploited to corrupt memory.
7) An error when processing Director files can be exploited to
overwrite 4 bytes of memory.
8) An error in the implementation of ordinal function 1409 in
iml32.dll can be exploited to corrupt heap memory via a specially
crafted Director file.
9) An error when processing a 4-byte field inside FFFFFF49h Shockwave
3D blocks can be exploited to corrupt heap memory.
10) An unspecified error can be exploited to corrupt memory.
11) A second unspecified error can be exploited to corrupt memory.
12) A third unspecified error can be exploited to corrupt memory.
13) A fourth unspecified error can be exploited to cause a buffer
overflow.
14) A fifth unspecified error can be exploited to corrupt memory.
15) A sixth unspecified error can be exploited to corrupt memory.
16) A seventh unspecified error can be exploited to corrupt memory.
17) An error when processing signed values encountered while parsing
"pami" RIFF chunks can be exploited to corrupt memory.
Successful exploitation of the vulnerabilities may allow execution of
arbitrary code.
The vulnerabilities are reported in versions 11.5.6.606 and prior on
Windows and Macintosh.
SOLUTION:
Update to version 11.5.7.609.
http://get.adobe.com/shockwave/
PROVIDED AND/OR DISCOVERED BY:
1-6) Alin Rad Pop, Secunia Research
The vendor also credits:
2) Nahuel Riva of Core Security Technologies.
3) Chaouki Bekrar of Vupen, Code Audit Labs, and an anonymous person
working with iDefense.
7) Chaouki Bekrar and Sebastien Renaud of Vupen, Code Audit Labs,
Gjoko Krstic of Zero Science Lab, and Chro HD of Fortinet's
FortiGuard Labs.
8, 17) an anonymous person working with ZDI.
9) Chaouki Bekrar of Vupen and an anonymous person working with ZDI.
10) Chaouki Bekrar of Vupen.
11-16) Chro HD of Fortinet's FortiGuard Labs.
CHANGELOG:
2010-05-12: Updated "Extended Description" and added PoCs for
vulnerabilities #2, #3, #4, and #6.
ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
Secunia Research:
http://secunia.com/secunia_research/2010-17/
http://secunia.com/secunia_research/2010-19/
http://secunia.com/secunia_research/2010-20/
http://secunia.com/secunia_research/2010-22/
http://secunia.com/secunia_research/2010-34/
http://secunia.com/secunia_research/2010-50/
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-087/
http://www.zerodayinitiative.com/advisories/ZDI-10-088/
http://www.zerodayinitiative.com/advisories/ZDI-10-089/
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=869
Code Audit Labs:
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0137.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0138.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0139.html
Zero Science Lab:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php
Core Security Technologies:
http://www.coresecurity.com/content/adobe-director-invalid-read
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
| VAR-201005-0101 | CVE-2010-1281 | Adobe Shockwave Player of iml32.dll Vulnerable to arbitrary code execution |
CVSS V2: 9.3 CVSS V3: 8.8 Severity: HIGH |
iml32.dll in Adobe Shockwave Player before 11.5.7.609 does not validate a certain value from a file before using it in file-pointer calculations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file. User interaction is required in that a target visit a malicious website.The specific flaw exists within the code responsible for parsing Director files. The vulnerable function is exported as an ordinal from the iml32.dll module. Ordinal 1409 trusts a value from the file as an offset and updates pointers accordingly. By crafting a large enough value and seeking the file pointer past the end of a buffer this can be abused to corrupt heap memory. An attacker can abuse this to execute arbitrary code under the context of the user running the browser. Failed exploit attempts may cause a denial-of-service condition.
Versions prior to Shockwave Player 11.5.7.609 are vulnerable.
Note: This issue was previously covered in BID 40066 (Adobe Shockwave Player APSB10-12 Multiple Remote Vulnerabilities); it has been given its own record to better document it. Over 450 million Internet-enabled desktops have installed Adobe Shockwave Player. These people now have access to some of the best the Web has to offer - including dazzling 3D games and entertainment, interactive product demonstrations, and online learning applications. The vulnerable software fails to sanitize user input when processing .dir files resulting in a crash and overwrite of a few memory registers.<br/><br/> --------------------------------------------------------------------------------<br/><br/><code> (f94.ae4): Access violation - code c0000005 (first chance)<br/> First chance exceptions are reported before any exception handling.<br/> This exception may be expected and handled.<br/> eax=20a0a0a0 ebx=207d004c ecx=00000400 edx=41414140 esi=00000000 edi=a80487d8<br/> eip=68008bd6 esp=0012de4c ebp=00000400 iopl=0 nv up ei pl nz na pe nc<br/> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00050206<br/> *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Adobe Director 11\DIRAPI.dll<br/> *** ERROR: Symbol file could not be found. Defaulted to export symbols for DIRAPI.dll - <br/> DIRAPI!Ordinal14+0x3b16:<br/> 68008bd6 2b4f04 sub ecx,dword ptr [edi+4] ds:0023:a80487dc=????????<br/><br/>-----------------------<br/><br/>EAX FFFFFFFF<br/>ECX 41414141<br/>EDX FFFFFFFF<br/>EBX 00000018<br/>ESP 0012F3B4<br/>EBP 02793578<br/>ESI 0012F3C4<br/>EDI 02793578<br/>EIP 69009F1F IML32.69009F1F<br/></code><br/>--------------------------------------------------------------------------------<br/><br/>Tested on: Microsoft Windows XP Professional SP3 (English). ----------------------------------------------------------------------
Looking for a job?
Secunia is hiring skilled researchers and talented developers.
1) A boundary error while processing FFFFFF45h Shockwave 3D blocks
can be exploited to corrupt memory.
2) A signedness error in the processing of Director files can be
exploited to corrupt memory.
3) An array indexing error when processing Director files can be
exploited to corrupt memory.
4) An integer overflow error when processing Director files can be
exploited to corrupt memory.
5) An error when processing asset entries contained in Director files
can be exploited to corrupt memory.
6) A boundary error when processing embedded fonts can be exploited
to cause a heap-based buffer overflow via a specially crafted
Director file.
7) An error when processing Director files can be exploited to
overwrite 4 bytes of memory.
9) An error when processing a 4-byte field inside FFFFFF49h Shockwave
3D blocks can be exploited to corrupt heap memory.
10) An unspecified error can be exploited to corrupt memory.
11) A second unspecified error can be exploited to corrupt memory.
12) A third unspecified error can be exploited to corrupt memory.
13) A fourth unspecified error can be exploited to cause a buffer
overflow.
14) A fifth unspecified error can be exploited to corrupt memory.
15) A sixth unspecified error can be exploited to corrupt memory.
16) A seventh unspecified error can be exploited to corrupt memory.
17) An error when processing signed values encountered while parsing
"pami" RIFF chunks can be exploited to corrupt memory.
Successful exploitation of the vulnerabilities may allow execution of
arbitrary code.
SOLUTION:
Update to version 11.5.7.609.
http://get.adobe.com/shockwave/
PROVIDED AND/OR DISCOVERED BY:
1-6) Alin Rad Pop, Secunia Research
The vendor also credits:
2) Nahuel Riva of Core Security Technologies.
3) Chaouki Bekrar of Vupen, Code Audit Labs, and an anonymous person
working with iDefense.
7) Chaouki Bekrar and Sebastien Renaud of Vupen, Code Audit Labs,
Gjoko Krstic of Zero Science Lab, and Chro HD of Fortinet's
FortiGuard Labs.
8, 17) an anonymous person working with ZDI.
9) Chaouki Bekrar of Vupen and an anonymous person working with ZDI.
10) Chaouki Bekrar of Vupen.
11-16) Chro HD of Fortinet's FortiGuard Labs.
CHANGELOG:
2010-05-12: Updated "Extended Description" and added PoCs for
vulnerabilities #2, #3, #4, and #6.
ORIGINAL ADVISORY:
Adobe:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
Secunia Research:
http://secunia.com/secunia_research/2010-17/
http://secunia.com/secunia_research/2010-19/
http://secunia.com/secunia_research/2010-20/
http://secunia.com/secunia_research/2010-22/
http://secunia.com/secunia_research/2010-34/
http://secunia.com/secunia_research/2010-50/
ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-087/
http://www.zerodayinitiative.com/advisories/ZDI-10-088/
http://www.zerodayinitiative.com/advisories/ZDI-10-089/
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=869
Code Audit Labs:
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0137.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0138.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0139.html
Zero Science Lab:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php
Core Security Technologies:
http://www.coresecurity.com/content/adobe-director-invalid-read
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
----------------------------------------------------------------------
.
-- Vendor Response:
Adobe has issued an update to correct this vulnerability. More
details can be found at:
http://www.adobe.com/support/security/bulletins/apsb10-12.html
-- Disclosure Timeline:
2010-02-02 - Vulnerability reported to vendor
2010-05-11 - Coordinated public release of advisory
-- Credit:
This vulnerability was discovered by:
* Anonymous
-- About the Zero Day Initiative (ZDI):
Established by TippingPoint, The Zero Day Initiative (ZDI) represents
a best-of-breed model for rewarding security researchers for responsibly
disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research
through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is
used. TippingPoint does not re-sell the vulnerability details or any
exploit code. Instead, upon notifying the affected product vendor,
TippingPoint provides its customers with zero day protection through
its intrusion prevention technology. Explicit details regarding the
specifics of the vulnerability are not exposed to any parties until
an official vendor patch is publicly available. Furthermore, with the
altruistic aim of helping to secure a broader user base, TippingPoint
provides this vulnerability information confidentially to security
vendors (including competitors) who have a vulnerability protection or
mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/