Another version of (adobe's) Shockwave Player has been released. I will get to the details in just a bit... but wish to preface it with a comment:
For many years, I had kept shockwave on my computers. But, aside from running a test at its website, I don't know that I've EVER used it elsewhere. Accordingly, I have uninstalled it from all my PC's, and have yet to miss having it.
I'm sure SOMEONE out there will be using shockwave. If you do (perhaps for gaming??), you'll want to keep it. And if you want it, it should always be kept up to date (to confront the latest vulnerabilities that have been found in older versions).
If you don't use shockwave... or if you're unsure whether you do... I would suggest you simply remove it from your system. Should you subsequently encounter a website (or program??) that requires it, it will let you know... and you can easily download/reinstall it at that point.
Having said this, I will no longer be mentioning future shockwave updates. Shockwave users should continue to look for them on their own.
Description Some [highly critical] vulnerabilities have been reported in Adobe Shockwave Player, which can be exploited by malicious people to compromise a user's system.
1) A boundary error while processing FFFFFF45h Shockwave 3D blocks can be exploited to corrupt memory.
2) A signedness error in the processing of Director files can be exploited to corrupt memory.
3) An array indexing error when processing Director files can be exploited to corrupt memory.
4) An integer overflow error when processing Director files can be exploited to corrupt memory.
5) An error when processing asset entries contained in Director files can be exploited to corrupt memory.
6) A boundary error when processing embedded fonts can be exploited to cause a heap-based buffer overflow via a specially crafted Director file.
7) An error when processing Director files can be exploited to overwrite 4 bytes of memory.
8) An error in the implementation of ordinal function 1409 in iml32.dll can be exploited to corrupt heap memory via a specially crafted Director file.
9) An error when processing a 4-byte field inside FFFFFF49h Shockwave 3D blocks can be exploited to corrupt heap memory.
10) An unspecified error can be exploited to corrupt memory.
11) A second unspecified error can be exploited to corrupt memory.
12) A third unspecified error can be exploited to corrupt memory.
13) A fourth unspecified error can be exploited to cause a buffer overflow.
14) A fifth unspecified error can be exploited to corrupt memory.
15) A sixth unspecified error can be exploited to corrupt memory.
16) A seventh unspecified error can be exploited to corrupt memory.
17) An error when processing signed values encountered while parsing "pami" RIFF chunks can be exploited to corrupt memory.
Successful exploitation of the vulnerabilities may allow execution of arbitrary code.
The vulnerabilities are reported in versions 11.5.6.606 and prior on Windows and Macintosh.
Can't ever recall using a website that required Shockwave, although a quick search on "shockwave games" found a lot of online games that use it.
Considering the long list of Shockwave vulnerabilities patched with this latest update, I too have uninstalled it.
-------------------------------------
Which raises the question: How many other programs (particularly browser-related) have you installed that are not needed, and may pose a threat?
Just because Secunia (PSI or OSI) indicates you have the latest version may not necessarily mean they are safe. PSI tells me I have over 150 patched programs accumulated over several years (some necessary, many probably not).
No, Flash Player is a separate/distinct product from shockwave player --- both are owned by Adobe, which can add to one's confusing them. I have removed shockwave, but i retain flash.
flash is the "mechanism" through which many animations are run.; i.e., if you're on a web page and see things moving around / changing, it's often an indication of flash. [you can confirm this by RIGHT-clicking on the animation, to see its properties listed; if it's flash, it will say SETTINGS - ABOUT FLASH PLAYER.] if you want to see these animated features, you need to keep flash.
animations can consist of some charts, games, advertisements, and the like. (one potential "plus": by NOT having flash, you'll avoid any advertisements that use it).
I have been running tests, using the restricted version of IE that has NO ADD-ONS whatsoever. I have been able to get all my critical/financial work done without flash (and without java): I can see my bank and credit card statements/accounts, and pay my bills online. but I have a brokerage account that displays my asset allocation in the form of a pie-chart which uses flash, so i can't see that particular pie-chart without flash.
anyone who uses facebook's GAMES will want flash.
oh, one of my favorite screen savers [the doggie that licks my screen clean] uses flash.
by the way, some other programs, like Secunia'sPSI, use flash (to display its graph of how secure you've been on a week-to-week basis). [And for what it's worth, Secunia's OSI requires Java.]
personally, while it seems i can get lots done without flash, i believe the animations do add an extra degree of enjoyment to surfing... so I have chosen to keep flash around, to get the "full web experience".
Is the the same as "Flash" player? I went into the control panel to see if I had Shockwave and saw that I had Flash. Clicked on the icon to see if anymore info was available and was presented with several OA alerts about allowing or disallowing certain actions...after which the program disappeared. Could not locate it in the recycle bin so will have to download it again if needed for anything. Thanks for any info.
joe53
5 Journeyman
•
5772 Posts
•
17269 Points
255
0
Posted May 12th, 2010 20:00
I agree with ky:
Can't ever recall using a website that required Shockwave, although a quick search on "shockwave games" found a lot of online games that use it.
Considering the long list of Shockwave vulnerabilities patched with this latest update, I too have uninstalled it.
-------------------------------------
Which raises the question: How many other programs (particularly browser-related) have you installed that are not needed, and may pose a threat?
Just because Secunia (PSI or OSI) indicates you have the latest version may not necessarily mean they are safe. PSI tells me I have over 150 patched programs accumulated over several years (some necessary, many probably not).
Perhaps it's time to "cull the herd".