VU#546769: Adobe Shockwave player vulnerable to downgrading

Vulnerability Note VU#546769
Adobe Shockwave player vulnerable to downgrading

Original Release date: 17 Dec 2012 | Last revised: 17 Dec 2012

Overview

Adobe Shockwave Player may automatically install a legacy version of the runtime, which can increase the attack surface of systems that have Shockwave installed.

Description

Adobe Macromedia Shockwave Player is software that plays active web content developed in Macromedia and Adobe Director. According to the Director 11 and Shockwave 11 Whitepaper:

When the user launches Shockwave content from a browser, the Shockwave 11 ActiveX control is downloaded to the
<%System%>/Adobe/Shockwave 11 folder. If the HTML page does not specify the playerVersion as 11, the
Shockwave 10.4.0.025 ActiveX control is downloaded silently, and installed in the
<%System%>/Macromed/Shockwave10 folder.
Also:
The Shockwave auto-update mechanism installs Shockwave 11 only. The compatibility components of Shockwave
10.4.0.025 player are installed only when the user tries to play old Shockwave content with the compatibility
parameter set to 10 or blank.
Because of this design, attackers can simply target vulnerabilities in the Shockwave 10 runtime, or any of the Xtras provided by Shockwave 10. For example, the legacy version of Shockwave provides Flash 8.0.34.0, which contains multiple, known vulnerabilities.

Impact

By convincing a user to view a specially crafted Shockwave content (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user.

Solution

We are currently unaware of a practical solution to this problem. Please consider the following workarounds:

Limit access to Director files

Restricting the handling of untrusted Director content may help mitigate this vulnerability. See Securing Your Web Browser for more information. Consider using the NoScript extension to whitelist web sites that can run Shockwave Player in Mozilla browsers such as Firefox. See the NoScript FAQ for more information.

Disable the Shockwave Player ActiveX control in Internet Explorer

The Shockwave Player ActiveX control can be disabled in Internet Explorer by setting the kill bit for the following CLSIDs:
{166B1BCA-3F9C-11CF-8075-444553540000}
{233C1507-6A77-46A4-9443-F871F945D258}
More information about how to set the kill bit is available in Microsoft Support Document 240797.Alternatively, the following text can be saved as a .REG file and imported to set the kill bit for this control:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{166B1BCA-3F9C-11CF-8075-444553540000}]
“Compatibility Flags”=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{166B1BCA-3F9C-11CF-8075-444553540000}]
“Compatibility Flags”=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{233C1507-6A77-46A4-9443-F871F945D258}]
“Compatibility Flags”=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{233C1507-6A77-46A4-9443-F871F945D258}]
“Compatibility Flags”=dword:00000400
Use the Microsoft Enhanced Mitigation Experience Toolkit

The Microsoft Enhanced Mitigation Experience Toolkit (EMET) can be used to help prevent exploitation of this vulnerability. CERT/CC has created a video tutorial for setting up EMET 3.0 on Windows 7. Note that platforms that do not support ASLR, such as Windows XP and Windows Server 2003, will not receive the same level of protection that modern Windows platforms will.

Enable DEP in Microsoft Windows

Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts “Understanding DEP as a mitigation technology” part 1 and part 2. DEP should be used in conjunction with the application of patches or other mitigations described in this document.

Note that when relying on DEP for exploit mitigation, it is important to use a system that supports Address Space Layout Randomization (ASLR) as well. ASLR is not supported by Windows XP or Windows Server 2003 or earlier. ASLR was introduced with Microsoft Windows Vista and Windows Server 2008. Please see the Microsoft SRD blog entry: On the effectiveness of DEP and ASLR for more details.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedAdobeAffected27 Oct 201027 Oct 2011If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
0.0
AV:–/AC:–/Au:–/C:–/I:–/A:–

Temporal
0.0
E:ND/RL:ND/RC:ND

Environmental
0.0
CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

http://www.adobe.com/support/director/ts/documents/kb403195/Director11_Whitepaper.pdf
http://helpx.adobe.com/shockwave/kb/shockwave-xtras-downloading-overview.html

Credit

This vulnerability was reported by Will Dormann of the CERT/CC

This document was written by Will Dormann.

Other Information

CVE IDs:
CVE-2012-6270

Date Public:
17 Dec 2012

Date First Published:
17 Dec 2012

Date Last Updated:
17 Dec 2012

Severity Metric:
12.83

Document Revision:
20

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#323161: Adobe Shockwave player provides vulnerable Flash runtime

Vulnerability Note VU#323161
Adobe Shockwave player provides vulnerable Flash runtime

Original Release date: 17 Dec 2012 | Last revised: 17 Dec 2012

Overview

Adobe Shockwave Player Player 11.6.8.638 and earlier versions on the Windows and Macintosh operating systems provide a vulnerable version of the Flash runtime.

Description

Adobe Macromedia Shockwave Player is software that plays active web content developed in Macromedia and Adobe Director. Shockwave Player is available as an ActiveX control for Internet Explorer and as a plug-in for other web browsers. Shockwave is also available in “Full” and “Slim” installers. The “Slim” installer provides fewer Xtras, which may be installed on an on-demand basis when a Shockwave movie attempts to use them.

The “Full” installer for Shockwave player 11.6.8.638 provides Flash version 10.2.159.1, which was released on April 15, 2011.This version of Flash contains several exploitable vulnerabilities. Note that Shockwave uses its own Flash runtime, provided by the file Flash Asset.x32, rather than using a Flash runtime that may be installed on a system-wide basis.

Impact

By convincing a user to view a specially crafted Shockwave content (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user.

Solution

We are currently unaware of a practical solution to this problem. Please consider the following workarounds:

Limit access to Director files

Restricting the handling of untrusted Director content may help mitigate this vulnerability. See Securing Your Web Browser for more information. Consider using the NoScript extension to whitelist web sites that can run Shockwave Player in Mozilla browsers such as Firefox. See the NoScript FAQ for more information.

Disable the Shockwave Player ActiveX control in Internet Explorer

The Shockwave Player ActiveX control can be disabled in Internet Explorer by setting the kill bit for the following CLSIDs:
{166B1BCA-3F9C-11CF-8075-444553540000}
{233C1507-6A77-46A4-9443-F871F945D258}
More information about how to set the kill bit is available in Microsoft Support Document 240797.Alternatively, the following text can be saved as a .REG file and imported to set the kill bit for this control:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{166B1BCA-3F9C-11CF-8075-444553540000}]
“Compatibility Flags”=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{166B1BCA-3F9C-11CF-8075-444553540000}]
“Compatibility Flags”=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{233C1507-6A77-46A4-9443-F871F945D258}]
“Compatibility Flags”=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{233C1507-6A77-46A4-9443-F871F945D258}]
“Compatibility Flags”=dword:00000400
Use the Microsoft Enhanced Mitigation Experience Toolkit

The Microsoft Enhanced Mitigation Experience Toolkit (EMET) can be used to help prevent exploitation of this vulnerability. CERT/CC has created a video tutorial for setting up EMET 3.0 on Windows 7. Note that platforms that do not support ASLR, such as Windows XP and Windows Server 2003, will not receive the same level of protection that modern Windows platforms will.

Enable DEP in Microsoft Windows

Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts “Understanding DEP as a mitigation technology” part 1 and part 2. DEP should be used in conjunction with the application of patches or other mitigations described in this document.

Note that when relying on DEP for exploit mitigation, it is important to use a system that supports Address Space Layout Randomization (ASLR) as well. ASLR is not supported by Windows XP or Windows Server 2003 or earlier. ASLR was introduced with Microsoft Windows Vista and Windows Server 2008. Please see the Microsoft SRD blog entry: On the effectiveness of DEP and ASLR for more details.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedAdobeAffected27 Oct 201015 Dec 2010If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
0.0
AV:–/AC:–/Au:–/C:–/I:–/A:–

Temporal
0.0
E:ND/RL:ND/RC:ND

Environmental
0.0
CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

http://helpx.adobe.com/shockwave/kb/shockwave-xtras-downloading-overview.html
http://www.cert.org/tech_tips/securing_browser/

Credit

This vulnerability was reported by Will Dormann of the CERT/CC.

This document was written by Will Dormann.

Other Information

CVE IDs:
Unknown

Date Public:
17 Dec 2012

Date First Published:
17 Dec 2012

Date Last Updated:
17 Dec 2012

Severity Metric:
14.74

Document Revision:
19

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#519137: Adobe Shockwave player installs Xtras without prompting

Vulnerability Note VU#519137
Adobe Shockwave player installs Xtras without prompting

Original Release date: 17 Dec 2012 | Last revised: 17 Dec 2012

Overview

Adobe Shockwave Player installs Xtras that are signed by Adobe or Macromedia without prompting, which can allow an attacker to target vulnerabilities in older Xtras.

Description

Adobe Macromedia Shockwave Player is software that plays active web content developed in Macromedia and Adobe Director. Shockwave Player is available as an ActiveX control for Internet Explorer and as a plug-in for other web browsers. Shockwave is also available in “Full” and “Slim” installers. The “Slim” installer provides fewer Xtras.

When a Shockwave movie attempts to use an Xtra, it will download and install it as necessary. If the Xtra is signed by Adobe or Macromedia, it will be installed automatically without any user interaction. Because the location from which Shockwave downloads the Xtra is stored in the Shockwave movie itself, this can allow an attacker to host old, vulnerable Xtras that can be installed and exploited automatically when a Shockwave movie is played.

Impact

By convincing a user to view a specially crafted Shockwave content (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user.

Solution

We are currently unaware of a practical solution to this problem. Please consider the following workarounds:

Limit access to Director files

Restricting the handling of untrusted Director content may help mitigate this vulnerability. See Securing Your Web Browser for more information. Consider using the NoScript extension to whitelist web sites that can run Shockwave Player in Mozilla browsers such as Firefox. See the NoScript FAQ for more information.

Disable the Shockwave Player ActiveX control in Internet Explorer

The Shockwave Player ActiveX control can be disabled in Internet Explorer by setting the kill bit for the following CLSIDs:
{166B1BCA-3F9C-11CF-8075-444553540000}
{233C1507-6A77-46A4-9443-F871F945D258}
More information about how to set the kill bit is available in Microsoft Support Document 240797.Alternatively, the following text can be saved as a .REG file and imported to set the kill bit for this control:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{166B1BCA-3F9C-11CF-8075-444553540000}]
“Compatibility Flags”=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{166B1BCA-3F9C-11CF-8075-444553540000}]
“Compatibility Flags”=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{233C1507-6A77-46A4-9443-F871F945D258}]
“Compatibility Flags”=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{233C1507-6A77-46A4-9443-F871F945D258}]
“Compatibility Flags”=dword:00000400
Use the Microsoft Enhanced Mitigation Experience Toolkit

The Microsoft Enhanced Mitigation Experience Toolkit (EMET) can be used to help prevent exploitation of this vulnerability. CERT/CC has created a video tutorial for setting up EMET 3.0 on Windows 7. Note that platforms that do not support ASLR, such as Windows XP and Windows Server 2003, will not receive the same level of protection that modern Windows platforms will.

Enable DEP in Microsoft Windows

Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts “Understanding DEP as a mitigation technology” part 1 and part 2. DEP should be used in conjunction with the application of patches or other mitigations described in this document.

Note that when relying on DEP for exploit mitigation, it is important to use a system that supports Address Space Layout Randomization (ASLR) as well. ASLR is not supported by Windows XP or Windows Server 2003 or earlier. ASLR was introduced with Microsoft Windows Vista and Windows Server 2008. Please see the Microsoft SRD blog entry: On the effectiveness of DEP and ASLR for more details.

Use the “Full” Shockwave installer instead of the “Slim” one

In order for an attacker to install an older, vulnerable Xtra on a system with Shockwave, that Xtra must not already be present on the system. If you must have Shockwave installed, using the “Full” installer will cause more Xtras to be present, limiting the choices that an attacker may be able to leverage to exploit. For example, the “Slim” installer for Shockwave does not provide the Flash Xtra. An attacker could target this installation configuration by hosting an arbitrary version of the Flash Xtra that would be automatically installed and exploited upon viewing a malicious Shockwave movie.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedAdobeAffected27 Oct 201017 Dec 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
0.0
AV:–/AC:–/Au:–/C:–/I:–/A:–

Temporal
0.0
E:ND/RL:ND/RC:ND

Environmental
0.0
CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

http://www.adobe.com/support/director/xtras.html
http://helpx.adobe.com/shockwave/kb/shockwave-xtras-downloading-overview.html

Credit

This vulnerability was reported by Will Dormann of the CERT/CC.

This document was written by Will Dormann.

Other Information

CVE IDs:
CVE-2012-6271

Date Public:
17 Dec 2012

Date First Published:
17 Dec 2012

Date Last Updated:
17 Dec 2012

Document Revision:
12

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#546769: Adobe Shockwave player vulnerable to downgrading

Vulnerability Note VU#546769
Adobe Shockwave player vulnerable to downgrading

Original Release date: 17 Dec 2012 | Last revised: 15 Jan 2013

Overview

Adobe Shockwave Player may automatically install a legacy version of the runtime, which can increase the attack surface of systems that have Shockwave installed.

Description

Adobe Macromedia Shockwave Player is software that plays active web content developed in Macromedia and Adobe Director. According to the Director 11 and Shockwave 11 Whitepaper:

When the user launches Shockwave content from a browser, the Shockwave 11 ActiveX control is downloaded to the
<%System%>/Adobe/Shockwave 11 folder. If the HTML page does not specify the playerVersion as 11, the
Shockwave 10.4.0.025 ActiveX control is downloaded silently, and installed in the
<%System%>/Macromed/Shockwave10 folder.
Also:
The Shockwave auto-update mechanism installs Shockwave 11 only. The compatibility components of Shockwave
10.4.0.025 player are installed only when the user tries to play old Shockwave content with the compatibility
parameter set to 10 or blank.
Because of this design, attackers can simply target vulnerabilities in the Shockwave 10 runtime, or any of the Xtras provided by Shockwave 10. For example, the legacy version of Shockwave provides Flash 8.0.34.0, which was released on November 14, 2006 and contains multiple, known vulnerabilities.

Impact

By convincing a user to view a specially crafted Shockwave content (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user.

Solution

We are currently unaware of a practical solution to this problem. Please consider the following workarounds:

Limit access to Director files

Restricting the handling of untrusted Director content may help mitigate this vulnerability. See Securing Your Web Browser for more information. Consider using the NoScript extension to whitelist web sites that can run Shockwave Player in Mozilla browsers such as Firefox. See the NoScript FAQ for more information.

Disable the Shockwave Player ActiveX control in Internet Explorer

The Shockwave Player ActiveX control can be disabled in Internet Explorer by setting the kill bit for the following CLSIDs:
{166B1BCA-3F9C-11CF-8075-444553540000}
{233C1507-6A77-46A4-9443-F871F945D258}
More information about how to set the kill bit is available in Microsoft Support Document 240797.Alternatively, the following text can be saved as a .REG file and imported to set the kill bit for this control:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{166B1BCA-3F9C-11CF-8075-444553540000}]
“Compatibility Flags”=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{166B1BCA-3F9C-11CF-8075-444553540000}]
“Compatibility Flags”=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{233C1507-6A77-46A4-9443-F871F945D258}]
“Compatibility Flags”=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{233C1507-6A77-46A4-9443-F871F945D258}]
“Compatibility Flags”=dword:00000400
Use the Microsoft Enhanced Mitigation Experience Toolkit

The Microsoft Enhanced Mitigation Experience Toolkit (EMET) can be used to help prevent exploitation of this vulnerability. CERT/CC has created a video tutorial for setting up EMET 3.0 on Windows 7. Note that platforms that do not support ASLR, such as Windows XP and Windows Server 2003, will not receive the same level of protection that modern Windows platforms will.

Enable DEP in Microsoft Windows

Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts “Understanding DEP as a mitigation technology” part 1 and part 2. DEP should be used in conjunction with the application of patches or other mitigations described in this document.

Note that when relying on DEP for exploit mitigation, it is important to use a system that supports Address Space Layout Randomization (ASLR) as well. ASLR is not supported by Windows XP or Windows Server 2003 or earlier. ASLR was introduced with Microsoft Windows Vista and Windows Server 2008. Please see the Microsoft SRD blog entry: On the effectiveness of DEP and ASLR for more details.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedAdobeAffected27 Oct 201027 Oct 2011If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
0.0
AV:–/AC:–/Au:–/C:–/I:–/A:–

Temporal
0.0
E:ND/RL:ND/RC:ND

Environmental
0.0
CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

http://www.kb.cert.org/vuls/id/323161
http://www.kb.cert.org/vuls/id/519137

http://www.adobe.com/support/director/ts/documents/kb403195/Director11_Whitepaper.pdf
http://helpx.adobe.com/shockwave/kb/shockwave-xtras-downloading-overview.html

Credit

This vulnerability was reported by Will Dormann of the CERT/CC

This document was written by Will Dormann.

Other Information

CVE IDs:
CVE-2012-6270

Date Public:
17 Dec 2012

Date First Published:
17 Dec 2012

Date Last Updated:
15 Jan 2013

Severity Metric:
12.83

Document Revision:
26

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#323161: Adobe Shockwave player provides vulnerable Flash runtime

Vulnerability Note VU#323161
Adobe Shockwave player provides vulnerable Flash runtime

Original Release date: 17 Dec 2012 | Last revised: 15 Jan 2013

Overview

Adobe Shockwave Player 11.6.8.638 and earlier versions on the Windows and Macintosh operating systems provide a vulnerable version of the Flash runtime.

Description

Adobe Macromedia Shockwave Player is software that plays active web content developed in Macromedia and Adobe Director. Shockwave Player is available as an ActiveX control for Internet Explorer and as a plug-in for other web browsers. Shockwave is also available in “Full” and “Slim” installers. The “Slim” installer provides fewer Xtras, which may be installed on an on-demand basis when a Shockwave movie attempts to use them.

The “Full” installer for Shockwave player 11.6.8.638 provides Flash version 10.2.159.1, which was released on April 15, 2011.This version of Flash contains several exploitable vulnerabilities. Note that Shockwave uses its own Flash runtime, provided by the file Flash Asset.x32, rather than using a Flash runtime that may be installed on a system-wide basis.

Impact

By convincing a user to view a specially crafted Shockwave content (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user.

Solution

We are currently unaware of a practical solution to this problem. Please consider the following workarounds:

Limit access to Director files

Restricting the handling of untrusted Director content may help mitigate this vulnerability. See Securing Your Web Browser for more information. Consider using the NoScript extension to whitelist web sites that can run Shockwave Player in Mozilla browsers such as Firefox. See the NoScript FAQ for more information.

Disable the Shockwave Player ActiveX control in Internet Explorer

The Shockwave Player ActiveX control can be disabled in Internet Explorer by setting the kill bit for the following CLSIDs:
{166B1BCA-3F9C-11CF-8075-444553540000}
{233C1507-6A77-46A4-9443-F871F945D258}
More information about how to set the kill bit is available in Microsoft Support Document 240797.Alternatively, the following text can be saved as a .REG file and imported to set the kill bit for this control:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{166B1BCA-3F9C-11CF-8075-444553540000}]
“Compatibility Flags”=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{166B1BCA-3F9C-11CF-8075-444553540000}]
“Compatibility Flags”=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{233C1507-6A77-46A4-9443-F871F945D258}]
“Compatibility Flags”=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{233C1507-6A77-46A4-9443-F871F945D258}]
“Compatibility Flags”=dword:00000400
Use the Microsoft Enhanced Mitigation Experience Toolkit

The Microsoft Enhanced Mitigation Experience Toolkit (EMET) can be used to help prevent exploitation of this vulnerability. CERT/CC has created a video tutorial for setting up EMET 3.0 on Windows 7. Note that platforms that do not support ASLR, such as Windows XP and Windows Server 2003, will not receive the same level of protection that modern Windows platforms will.

Enable DEP in Microsoft Windows

Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts “Understanding DEP as a mitigation technology” part 1 and part 2. DEP should be used in conjunction with the application of patches or other mitigations described in this document.

Note that when relying on DEP for exploit mitigation, it is important to use a system that supports Address Space Layout Randomization (ASLR) as well. ASLR is not supported by Windows XP or Windows Server 2003 or earlier. ASLR was introduced with Microsoft Windows Vista and Windows Server 2008. Please see the Microsoft SRD blog entry: On the effectiveness of DEP and ASLR for more details.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedAdobeAffected27 Oct 201015 Dec 2010If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
0.0
AV:–/AC:–/Au:–/C:–/I:–/A:–

Temporal
0.0
E:ND/RL:ND/RC:ND

Environmental
0.0
CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

http://www.kb.cert.org/vuls/id/546769
http://www.kb.cert.org/vuls/id/519137

http://helpx.adobe.com/shockwave/kb/shockwave-xtras-downloading-overview.html
http://www.cert.org/tech_tips/securing_browser/

Credit

This vulnerability was reported by Will Dormann of the CERT/CC.

This document was written by Will Dormann.

Other Information

CVE IDs:
Unknown

Date Public:
17 Dec 2012

Date First Published:
17 Dec 2012

Date Last Updated:
15 Jan 2013

Severity Metric:
14.74

Document Revision:
25

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#519137: Adobe Shockwave player installs Xtras without prompting

Vulnerability Note VU#519137
Adobe Shockwave player installs Xtras without prompting

Original Release date: 17 Dec 2012 | Last revised: 15 Jan 2013

Overview

Adobe Shockwave Player installs Xtras that are signed by Adobe or Macromedia without prompting, which can allow an attacker to target vulnerabilities in older Xtras.

Description

Adobe Macromedia Shockwave Player is software that plays active web content developed in Macromedia and Adobe Director. Shockwave Player is available as an ActiveX control for Internet Explorer and as a plug-in for other web browsers. Shockwave is also available in “Full” and “Slim” installers. The “Slim” installer provides fewer Xtras.

When a Shockwave movie attempts to use an Xtra, it will download and install it as necessary. If the Xtra is signed by Adobe or Macromedia, it will be installed automatically without any user interaction. Because the location from which Shockwave downloads the Xtra is stored in the Shockwave movie itself, this can allow an attacker to host old, vulnerable Xtras that can be installed and exploited automatically when a Shockwave movie is played.

Impact

By convincing a user to view a specially crafted Shockwave content (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user.

Solution

We are currently unaware of a practical solution to this problem. Please consider the following workarounds:

Limit access to Director files

Restricting the handling of untrusted Director content may help mitigate this vulnerability. See Securing Your Web Browser for more information. Consider using the NoScript extension to whitelist web sites that can run Shockwave Player in Mozilla browsers such as Firefox. See the NoScript FAQ for more information.

Disable the Shockwave Player ActiveX control in Internet Explorer

The Shockwave Player ActiveX control can be disabled in Internet Explorer by setting the kill bit for the following CLSIDs:
{166B1BCA-3F9C-11CF-8075-444553540000}
{233C1507-6A77-46A4-9443-F871F945D258}
More information about how to set the kill bit is available in Microsoft Support Document 240797.Alternatively, the following text can be saved as a .REG file and imported to set the kill bit for this control:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{166B1BCA-3F9C-11CF-8075-444553540000}]
“Compatibility Flags”=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{166B1BCA-3F9C-11CF-8075-444553540000}]
“Compatibility Flags”=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{233C1507-6A77-46A4-9443-F871F945D258}]
“Compatibility Flags”=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{233C1507-6A77-46A4-9443-F871F945D258}]
“Compatibility Flags”=dword:00000400
Use the Microsoft Enhanced Mitigation Experience Toolkit

The Microsoft Enhanced Mitigation Experience Toolkit (EMET) can be used to help prevent exploitation of this vulnerability. CERT/CC has created a video tutorial for setting up EMET 3.0 on Windows 7. Note that platforms that do not support ASLR, such as Windows XP and Windows Server 2003, will not receive the same level of protection that modern Windows platforms will.

Enable DEP in Microsoft Windows

Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts “Understanding DEP as a mitigation technology” part 1 and part 2. DEP should be used in conjunction with the application of patches or other mitigations described in this document.

Note that when relying on DEP for exploit mitigation, it is important to use a system that supports Address Space Layout Randomization (ASLR) as well. ASLR is not supported by Windows XP or Windows Server 2003 or earlier. ASLR was introduced with Microsoft Windows Vista and Windows Server 2008. Please see the Microsoft SRD blog entry: On the effectiveness of DEP and ASLR for more details.

Use the “Full” Shockwave installer instead of the “Slim” one

In order for an attacker to install an older, vulnerable Xtra on a system with Shockwave, that Xtra must not already be present on the system. If you must have Shockwave installed, using the “Full” installer will cause more Xtras to be present, limiting the choices that an attacker may be able to leverage to exploit. For example, the “Slim” installer for Shockwave does not provide the Flash Xtra. An attacker could target this installation configuration by hosting an arbitrary version of the Flash Xtra that would be automatically installed and exploited upon viewing a malicious Shockwave movie. Note that as long as VU#323161 is valid, this workaround may not be effective in protecting against Flash vulnerabilities.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedAdobeAffected27 Oct 201017 Dec 2012If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
0.0
AV:–/AC:–/Au:–/C:–/I:–/A:–

Temporal
0.0
E:ND/RL:ND/RC:ND

Environmental
0.0
CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

http://www.kb.cert.org/vuls/id/323161
http://www.kb.cert.org/vuls/id/546769

http://www.adobe.com/support/director/xtras.html
http://helpx.adobe.com/shockwave/kb/shockwave-xtras-downloading-overview.html

Credit

This vulnerability was reported by Will Dormann of the CERT/CC.

This document was written by Will Dormann.

Other Information

CVE IDs:
CVE-2012-6271

Date Public:
17 Dec 2012

Date First Published:
17 Dec 2012

Date Last Updated:
15 Jan 2013

Document Revision:
19

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VU#759307: Adobe Acrobat and Reader U3D memory corruption vulnerability

Vulnerability Note VU#759307
Adobe Acrobat and Reader U3D memory corruption vulnerability
OverviewAdobe Reader and Acrobat fail to properly handle U3D data, which could allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
I. DescriptionAdobe Reader supports two primary formats for 3D content in PDF documents: U3D and PRC. U3D support is accomplished via the Right Hemisphere …