Adobe Acrobat and Reader 8.1.2 Multiple Security Vulnerabilities

Bugtraq ID:	32100
Class:	Unknown
CVE:	CVE-2008-4812 CVE-2008-4813 CVE-2008-4814 CVE-2008-4815
Remote:	Yes
Local:	No
Published:	Nov 04 2008 12:00AM
Updated:	Jan 30 2013 09:10AM
Credit:	Greg MacManus of iDefense Labs, an anonymous researcher working with iDefense Labs, Javier Vicente Vallejo, Peter Vregdenhil, Thomas Garnier, and Josh Bressers.
Vulnerable:	SuSE SUSE Linux Enterprise Server 9 SP3 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SP2 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise SDK 10 SP1 SuSE SUSE Linux Enterprise SDK 10 SuSE SUSE Linux Enterprise Desktop 10 SP2 SuSE SUSE Linux Enterprise Desktop 10 SP1 SuSE SUSE Linux Enterprise Desktop 10 SuSE SUSE Linux Enterprise 10 SP2 DEBUGINFO SuSE SUSE Linux Enterprise 10 SP1 DEBUGINFO SuSE openSUSE 10.3 SuSE Linux Professional 10.2 x86_64 SuSE Linux Personal 10.2 x86_64 Sun Solaris 10_sparc S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. SuSE Linux Open-Xchange 4.1 S.u.S.E. SUSE Linux Enterprise Server RT Solution 10 0 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.2 S.u.S.E. openSUSE 10.1 S.u.S.E. Open-Enterprise-Server 9.0 S.u.S.E. Open-Enterprise-Server 1 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux Desktop SDK 9.0 S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 10.2 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 10.2 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux 10.1 x86-64 S.u.S.E. Linux 10.1 x86 S.u.S.E. Linux 10.1 ppc64 S.u.S.E. Linux 10.1 ppc S.u.S.E. Linux 10.0 x86-64 S.u.S.E. Linux 10.0 x86 S.u.S.E. Linux 10.0 ppc RedHat Enterprise Linux ES Extras 4 RedHat Enterprise Linux ES Extras 3 Red Hat Enterprise Linux Supplementary 5 server Red Hat Enterprise Linux Desktop Supplementary 5 client Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service - CCSS7 0 Nortel Networks CallPilot 703t Nortel Networks CallPilot 600r Nortel Networks CallPilot 201i Nortel Networks CallPilot 1005r Nortel Networks CallPilot 1002rp Gentoo Linux Avaya IR 3.0 Avaya Interactive Response 3.0 Avaya Interactive Response 2.0 Adobe Reader 8.1.2 Adobe Reader 8.1.1 Adobe Reader 7.0.9 Adobe Reader 7.0.8 Adobe Reader 7.0.7 Adobe Reader 7.0.6 Adobe Reader 7.0.5 Adobe Reader 7.0.4 Adobe Reader 7.0.3 Adobe Reader 7.0.2 Adobe Reader 7.0.1 Adobe Reader 7.0 Adobe Reader 8.1.2 Security Updat Adobe Reader 8.1 Adobe Reader 8.0 Adobe Reader 7.1 Adobe Acrobat Standard 8.1.2 Adobe Acrobat Standard 8.1.1 Adobe Acrobat Standard 7.0.8 Adobe Acrobat Standard 7.0.7 Adobe Acrobat Standard 7.0.6 Adobe Acrobat Standard 7.0.5 Adobe Acrobat Standard 7.0.4 Adobe Acrobat Standard 7.0.3 Adobe Acrobat Standard 7.0.2 Adobe Acrobat Standard 7.0.1 Adobe Acrobat Standard 7.0 Adobe Acrobat Standard 8.1 Adobe Acrobat Standard 8.0 Adobe Acrobat Standard 7.1 Adobe Acrobat Professional 8.1.2 Adobe Acrobat Professional 8.1.1 Adobe Acrobat Professional 7.0.9 Adobe Acrobat Professional 7.0.8 Adobe Acrobat Professional 7.0.7 Adobe Acrobat Professional 7.0.6 Adobe Acrobat Professional 7.0.5 Adobe Acrobat Professional 7.0.4 Adobe Acrobat Professional 7.0.3 Adobe Acrobat Professional 7.0.2 Adobe Acrobat Professional 7.0.1 Adobe Acrobat Professional 7.0 Adobe Acrobat Professional 8.1.2 Security Updat Adobe Acrobat Professional 8.1 Adobe Acrobat Professional 8.0 Adobe Acrobat Professional 7.1 Adobe Acrobat 3D 8.1.2
Not Vulnerable:	Adobe Reader 8.1.3 Adobe Reader 7.1.1 Adobe Reader 9 Adobe Acrobat Standard 8.1.3 Adobe Acrobat Standard 7.1.1 Adobe Acrobat Professional 8.1.3 Adobe Acrobat Professional 7.1.1 Adobe Acrobat 3D 8.1.3

Adobe Acrobat and Reader 8.1.2 Multiple Security Vulnerabilities

Adobe Acrobat and Reader are prone to multiple security vulnerabilities:

1. Multiple remote code-execution vulnerabilities.
2. A privilege-escalation vulnerability affecting computers running Unix-like operating systems.
3. An input-validation issue in a JavaScript method may lead to remote code execution.

Attackers can exploit these issues to execute arbitrary code, elevate privileges, or cause a denial-of-service condition.

Adobe Acrobat and Reader 8.1.2 Multiple Security Vulnerabilities

FrSIRT has developed a working commercial exploit for the Type 1 Font issue. This exploit is not otherwise publicly available or known to be circulating in the wild.

Adobe Acrobat and Reader 8.1.2 Multiple Security Vulnerabilities

Solution:
The vendor released an update to address these issues. Please see the references for more information.

Adobe Acrobat and Reader 8.1.2 Multiple Security Vulnerabilities

References:

• Adobe Acrobat PDF Javascript getCosObj Memory Corruption Vulnerability (Zero Day Initiative)
  
• Adobe Acrobat Reader Malformed PDF Code Execution (Zero Day Initiative)
  
• Adobe Homepage (Adobe)
  
• Adobe Reader Embedded Font Handling Out of Bounds Array Indexing Vulnerability (Adobe)
  
• iDefense Security Advisory 11.04.08: Adobe Reader Embedded Font Handling Out of (iDefense Labs )
  
• ZDI-08-073: Adobe Acrobat Reader Malformed PDF Code Execution Vulnerability ([email protected] )
  
• ZDI-08-074: Adobe Acrobat PDF Javascript getCosObj Memory Corruption Vulnerabili ([email protected])
  
• Nortel Response to Adobe Vulnerability Identifier APSB08-19 (Nortel Networks)
  
• 256788 Multiple Security Vulnerabilities in Adobe Reader for Solaris 10 (Sun)
  
• APSB08-19 Security Update available for Adobe Reader 8 and Acrobat 8 (Adobe)
  
• APSB09-04 Security Updates available for Adobe Reader and Acrobat (Adobe)
  
• ASA-2009-018 Multiple Security Vulnerabilities in the Adobe Reader May Lead to E (Avaya)
  
• Nortel Response to Sun Alert 249366 - Solaris 10 - Multiple Security Vulnerabili (Nortel Networks)
  
• Solution 249366: Multiple Security Vulnerabilities in the Adobe Reader May Lead (Sun)