Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Critical Shockwave Install Bug Fixed

A critical vulnerability in the popular Shockwave player was disclosed Thursday by a bug bounty program, and patched that same day by Adobe.

TippingPoint's Zero Day Initiative -- one of two prominent reward programs that pay researchers for information about software vulnerabilities -- warned users that a malicious Web site could hijack a user's computer if the site convinced the visitor to install Shockwave, a player used on many sites to display multi-media content.

Shockwave's ActiveX installer was at fault, said TippingPoint in its advisory.

Adobe, meanwhile, repaired the defective ActiveX installer, and said "since the vulnerability occurs in the installer, no action needs to be taken by current Macromedia Shockwave Player customers."

In other words, Shockwave users can breathe easy.

  • 1