Adobe Acrobat Reader Remote Code Execution Vulnerability

Bugtraq ID:	36600
Class:	Unknown
CVE:	CVE-2009-3459
Remote:	Yes
Local:	No
Published:	Oct 08 2009 12:00AM
Updated:	Mar 19 2015 08:33AM
Credit:	Chia-Ching Fang and the Information and Communication Security Technology Service Center
Vulnerable:	SuSE Suse Linux Enterprise Desktop 11 SuSE Suse Linux Enterprise Desktop 10 SP3 SuSE Suse Linux Enterprise Desktop 10 SP2 Sun Solaris 10_sparc S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 Redhat Enterprise Linux WS Extras 4 Redhat Enterprise Linux WS Extras 3 Redhat Enterprise Linux Supplementary 5 server Redhat Enterprise Linux Extras 4 Redhat Enterprise Linux Extras 3 Redhat Enterprise Linux ES Extras 4 Redhat Enterprise Linux ES Extras 3 Redhat Enterprise Linux Desktop Supplementary 5 client Redhat Enterprise Linux AS Extras 4 Redhat Enterprise Linux AS Extras 3 Redhat Desktop Extras 4 Redhat Desktop Extras 3 Gentoo Linux Adobe Reader 9.1.3 Adobe Reader 9.1.2 Adobe Reader 9.1.1 Adobe Reader 8.1.6 Adobe Reader 8.1.5 Adobe Reader 8.1.4 Adobe Reader 8.1.3 Adobe Reader 8.1.2 Adobe Reader 8.1.1 Adobe Reader 7.1.2 Adobe Reader 7.1.1 Adobe Reader 7.0.9 Adobe Reader 7.0.8 Adobe Reader 7.0.7 Adobe Reader 7.0.6 Adobe Reader 7.0.5 Adobe Reader 7.0.4 Adobe Reader 7.0.3 Adobe Reader 7.0.2 Adobe Reader 7.0.1 Adobe Reader 7.0 Adobe Reader 9.1 Adobe Reader 9.0 Adobe Reader 8.1.2 Security Updat Adobe Reader 8.1 Adobe Reader 8.0 Adobe Reader 7.1 Adobe Acrobat Standard 9.1.3 Adobe Acrobat Standard 9.1.2 Adobe Acrobat Standard 8.1.6 Adobe Acrobat Standard 8.1.4 Adobe Acrobat Standard 8.1.3 Adobe Acrobat Standard 8.1.2 Adobe Acrobat Standard 8.1.1 Adobe Acrobat Standard 7.1.3 Adobe Acrobat Standard 7.1.1 Adobe Acrobat Standard 7.0.8 Adobe Acrobat Standard 7.0.7 Adobe Acrobat Standard 7.0.6 Adobe Acrobat Standard 7.0.5 Adobe Acrobat Standard 7.0.4 Adobe Acrobat Standard 7.0.3 Adobe Acrobat Standard 7.0.2 Adobe Acrobat Standard 7.0.1 Adobe Acrobat Standard 7.0 Adobe Acrobat Standard 9.1 Adobe Acrobat Standard 9 Adobe Acrobat Standard 8.1 Adobe Acrobat Standard 8.0 Adobe Acrobat Standard 7.1 Adobe Acrobat Professional 9.1.3 Adobe Acrobat Professional 9.1.2 Adobe Acrobat Professional 8.1.6 Adobe Acrobat Professional 8.1.4 Adobe Acrobat Professional 8.1.3 Adobe Acrobat Professional 8.1.2 Adobe Acrobat Professional 8.1.1 Adobe Acrobat Professional 7.1.3 Adobe Acrobat Professional 7.1.1 Adobe Acrobat Professional 7.0.9 Adobe Acrobat Professional 7.0.8 Adobe Acrobat Professional 7.0.7 Adobe Acrobat Professional 7.0.6 Adobe Acrobat Professional 7.0.5 Adobe Acrobat Professional 7.0.4 Adobe Acrobat Professional 7.0.3 Adobe Acrobat Professional 7.0.2 Adobe Acrobat Professional 7.0.1 Adobe Acrobat Professional 7.0 Adobe Acrobat Professional 9.1 Adobe Acrobat Professional 9 Adobe Acrobat Professional 8.1.2 Security Updat Adobe Acrobat Professional 8.1 Adobe Acrobat Professional 8.0 Adobe Acrobat Professional 7.1 Adobe Acrobat 9.1.1 Adobe Acrobat 7.0.3 Adobe Acrobat 7.0.2 Adobe Acrobat 7.0.1 Adobe Acrobat 7.0
Not Vulnerable:	Adobe Reader 8.1.7 Adobe Reader 7.1.4 Adobe Reader 9.2 Adobe Acrobat Standard 8.1.7 Adobe Acrobat Standard 7.1.4 Adobe Acrobat Standard 9.2 Adobe Acrobat Professional 8.1.7 Adobe Acrobat Professional 7.1.4 Adobe Acrobat Professional 9.2

Adobe Acrobat Reader Remote Code Execution Vulnerability

Adobe Acrobat Reader is prone to a remote code-execution vulnerability.

An attacker can exploit this issue by supplying a malicious PDF file. Successful exploits may allow the attacker to execute arbitrary code in the context of a user running the affected application. Failed attempts will likely result in denial-of-service conditions.

Adobe Acrobat Reader Remote Code Execution Vulnerability

This issue is currently being exploited in the wild in limited targeted attacks.

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploit code is available:

• /data/vulnerabilities/exploits/36600.rb

Adobe Acrobat Reader Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for details.


S.u.S.E. openSUSE 11.0

• S.u.S.E. acroread-8.1.7-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/acroread-8.1.7-0.1.i 586.rpm

S.u.S.E. openSUSE 11.1

• S.u.S.E. acroread-8.1.7-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/acroread-8.1.7-0.1.1 .i586.rpm

Adobe Acrobat Reader Remote Code Execution Vulnerability

References:

• Adobe Homepage (Adobe)
  
• Adobe Reader and Acrobat issue (Adobe)
  
• Smashing Adobe's Heap Memory Management (Fortinet)
  
• In-depth research on the recent PDF zero-day exploit (CVE-2009-3459) (cocoruder )
  
• APSB09-15 Security Advisory for Adobe Reader and Acrobat (Adobe)
  
• APSB09-15 Security Updates Available for Adobe Reader and Acrobat (Adobe)
  
• Multiple Security Vulnerabilities in Adobe Reader for Solaris 10 May Allow Execu (Sun)