-----BEGIN PGP SIGNED MESSAGE-----
AUSCERT Security Bulletin
Security vulnerabilities in Adobe Shockwave Player
21 December 2012
AusCERT Security Bulletin Summary
Product: Adobe Shockwave Player version 184.108.40.2068 and prior
Operating System: Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
CVE Names: CVE-2012-6271 CVE-2012-6270
Member content until: Sunday, January 20 2013
Vulnerabilities have been found in Adobe Shockwave Player which could
lead to reduced security up to and including execution of arbitrary
(CVE-2012-6270) Adobe Shockwave Player may install an older version
of the runtime, enabling attackers to target known vulnerabilities
in legacy versions.
In addition, the full installer for Adobe Shockwave Player
220.127.116.118 installs an old version of Flash Player (10.2.159.1),
which contains multiple vulnerabilities known to be exploitable.
(CVE-2012-6271) It is possible for an attacker to reference the URL
of a legacy version of an "Xtra", a downloadable component for
Shockwave Player, in a Shockwave file. Since the URL is provided in
the Shockwave file, it is possible for an attacker to host a
vulnerable, legacy version of an Xtra and cause Shockwave Player to
download it. Provided the Xtra is signed by Macromedia or Adobe the
Xtra will be executed, possibly allowing execution of arbitrary
There is currently no patch available, however the following
mitigation strategies should be considered:
1. Uninstall Shockwave Player,
2. Disable the Shockwave Player ActiveX control in Internet Explorer.
Information is available from Microsoft's web site. 
3. Use the Microsoft Enhanced Mitigation Experience Toolkit , or
enable Data Execution Prevention in Windows. 
 US-CERT Vulnerability Note VU#323161 Adobe Shockwave player
provides vulnerable Flash runtime
 How to stop an ActiveX control from running in Internet Explorer
 The Enhanced Mitigation Experience Toolkit
 What is Data Execution Prevention?
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
Australian Computer Emergency Response Team
The University of Queensland
Internet Email: email@example.com
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----