MA-269.022011 : MyCERT Alert - Multiple Critical Vulnerabilities in Adobe Shockwave Player
Date of publication: 2011-02-09
Multiple critical vulnerabilities have been identified in the latest version of Adobe Shockwave Player (188.8.131.522).
This vulnerability allows a remote attacker to execute arbitrary code on a vulnerable version of Adobe Shockwave Player. User interaction is required where a user must visit a malicious web site, which is embedded with a specially crafted SWF file. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. 
By exploiting this vulnerability, an attacker could execute arbitrary code on vulnerable installations of Adobe Shockwave and gain the same privilege as the user. This vulnerability could be exploited to install malware on the user's computer.
3.0 Affected Products
Products listed below are vulnerable to this vulnerability:
- Shockwave Player 184.108.40.2065 and earlier versions for Windows and Macintosh
Users are of Adobe Shockwave Player 220.127.116.115 and earlier versions are recommended to upgrade to the newest version 18.104.22.1680. Update is available at the following URL:
MyCERT generally advise users of this product to keep themselves updated with the latest security announcements by the vendor. In case the public receives any suspicious URL, or .SWF file, and requires our further analysis, please reach us through the following channels:
E-mail : firstname.lastname@example.org
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT