Adobe has a dismal record for addressing security vulnerabilities in their software, some of which, e.g., Acrobat Reader and Shockwave, is widely used. Right on the heels of their announcement that they plan to step up their reactions to security issues, we see this story from ZDNet:

Critical Adobe Shockwave flaw affects millions
by Ryan Naraine
June 24th, 2009

Adobe’s Shockwave Player contains a critical vulnerability that could be exploited by remote hackers to take complete control of Windows computers, according to a warning from the software maker.

The flaw affects Adobe Shockwave Player 11.5.0.596 and earlier versions. Details from Adobe’s advisory:

This vulnerability could allow an attacker who successfully exploits this vulnerability to take control of the affected system. Adobe has provided a solution for the reported vulnerability (CVE-2009-1860). This issue was previously resolved in Shockwave Player 11.0.0.465; the Shockwave Player 11.5.0.600 update resolves a backwards compatibility mode variation of the issue with Shockwave Player 10 content. To resolve this issue, Shockwave Player users on Windows should uninstall Shockwave version 11.5.0.596 and earlier on their systems, restart, and install Shockwave version 11.5.0.600, available here: Adobe – Adobe Shockwave Player. This issue is remotely exploitable.

Adobe boasts that 450 million Internet-enabled desktops have installed Adobe Shockwave Player.

Another Adobe Critical Security Flaw – Shockwave is a post from: PsychNet Reviews and Recommendations

©2010 PsychNet Reviews and Recommendations. All Rights Reserved.

Related posts

• WordPress Install File Poses Security Risk (2)
• Basic Computer Security 2009 Part 2 (2)
• Basic Computer Security 2009 Part 1 (0)
• Adobe promises quarterly security updates. Quarterly??!!? (0)