Adobe Acrobat Stack Exhaustion Denial of Service Vulnerability

Bugtraq ID:	35148
Class:	Boundary Condition Error
CVE:	CVE-2009-3431
Remote:	Yes
Local:	No
Published:	May 29 2009 12:00AM
Updated:	Mar 19 2015 09:24AM
Credit:	Saint Patrick
Vulnerable:	SuSE SUSE Linux Enterprise Desktop 11 SuSE SUSE Linux Enterprise Desktop 10 SP3 SuSE SUSE Linux Enterprise Desktop 10 SP2 SuSE openSUSE 10.3 Sun Solaris 10_sparc S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 RedHat Enterprise Linux WS Extras 4 RedHat Enterprise Linux WS Extras 3 RedHat Enterprise Linux Extras 4 RedHat Enterprise Linux Extras 3 RedHat Enterprise Linux ES Extras 4 RedHat Enterprise Linux ES Extras 3 RedHat Enterprise Linux AS Extras 4 RedHat Enterprise Linux AS Extras 3 RedHat Desktop Extras 4 RedHat Desktop Extras 3 Red Hat Enterprise Linux Supplementary 5 server Red Hat Enterprise Linux Desktop Supplementary 5 client Gentoo Linux Adobe Reader 9.1.3 Adobe Reader 9.1.2 Adobe Reader 9.1.1 Adobe Reader 8.1.6 Adobe Reader 8.1.5 Adobe Reader 8.1.4 Adobe Reader 8.1.3 Adobe Reader 8.1.2 Adobe Reader 8.1.1 Adobe Reader 9.1 Adobe Reader 9 Adobe Reader 8.1.2 Security Updat Adobe Reader 8.1 Adobe Reader 8.0 Adobe Acrobat Standard 9.1.3 Adobe Acrobat Standard 9.1.2 Adobe Acrobat Standard 8.1.6 Adobe Acrobat Standard 8.1.4 Adobe Acrobat Standard 8.1.3 Adobe Acrobat Standard 8.1.2 Adobe Acrobat Standard 8.1.1 Adobe Acrobat Standard 9.1 Adobe Acrobat Standard 9 Adobe Acrobat Standard 8.1 Adobe Acrobat Standard 8.0 Adobe Acrobat Professional 9.1.3 Adobe Acrobat Professional 9.1.2 Adobe Acrobat Professional 8.1.6 Adobe Acrobat Professional 8.1.4 Adobe Acrobat Professional 8.1.3 Adobe Acrobat Professional 8.1.2 Adobe Acrobat Professional 8.1.1 Adobe Acrobat Professional 9.1 Adobe Acrobat Professional 9 Adobe Acrobat Professional 8.1.2 Security Updat Adobe Acrobat Professional 8.1 Adobe Acrobat Professional 8.0 Adobe Acrobat 9.1.1
Not Vulnerable:	Adobe Reader 8.1.7 Adobe Reader 9.2 Adobe Acrobat Standard 8.1.7 Adobe Acrobat Standard 9.2 Adobe Acrobat Professional 8.1.7 Adobe Acrobat Professional 9.2

Adobe Acrobat Stack Exhaustion Denial of Service Vulnerability

Adobe Acrobat is prone to a denial-of-service vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to cause the affected application to crash, effectively denying service. Attackers may also be able to execute arbitrary code, but this has not been confirmed.

Acrobat 9.1.1 is vulnerable; other versions may also be affected.

NOTE: This BID was previously classified as a buffer-overflow issue, but further analysis reveals that it is a stack-exhaustion issue. Code execution is unlikely.

Adobe Acrobat Stack Exhaustion Denial of Service Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/35148-PoC.pdf

Adobe Acrobat Stack Exhaustion Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


S.u.S.E. openSUSE 11.1

• S.u.S.E. acroread-8.1.7-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/acroread-8.1.7-0.1.1 .i586.rpm

S.u.S.E. openSUSE 11.0

• S.u.S.E. acroread-8.1.7-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/acroread-8.1.7-0.1.i 586.rpm

Adobe Acrobat Stack Exhaustion Denial of Service Vulnerability

References:

• Acrobat Homepage (Adobe)
  
• APSB09-15 Security Updates Available for Adobe Reader and Acrobat (Adobe)
  
• Multiple Security Vulnerabilities in Adobe Reader for Solaris 10 May Allow Execu (Sun)