Adobe Reader and Acrobat U3D File Invalid Array Index Remote Vulnerability

Bugtraq ID:	36665
Class:	Boundary Condition Error
CVE:	CVE-2009-2990
Remote:	Yes
Local:	No
Published:	Oct 13 2009 12:00AM
Updated:	Mar 19 2015 09:16AM
Credit:	Dionysus Blazakis
Vulnerable:	SuSE SUSE Linux Enterprise Desktop 11 SuSE SUSE Linux Enterprise Desktop 10 SP3 SuSE SUSE Linux Enterprise Desktop 10 SP2 SuSE openSUSE 10.3 Sun Solaris 10_sparc S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 Right Hemisphere Deep View 6.0.0.5899 Right Hemisphere Deep Exploration CAD Edition 6.0.0.5908 RedHat Enterprise Linux WS Extras 4 RedHat Enterprise Linux WS Extras 3 RedHat Enterprise Linux Extras 4 RedHat Enterprise Linux Extras 3 RedHat Enterprise Linux ES Extras 4 RedHat Enterprise Linux ES Extras 3 RedHat Enterprise Linux AS Extras 4 RedHat Enterprise Linux AS Extras 3 RedHat Desktop Extras 4 RedHat Desktop Extras 3 Red Hat Enterprise Linux Supplementary 5 server Red Hat Enterprise Linux Desktop Supplementary 5 client Gentoo Linux Adobe Reader 9.1.3 Adobe Reader 9.1.2 Adobe Reader 9.1.1 Adobe Reader 8.1.6 Adobe Reader 8.1.5 Adobe Reader 8.1.4 Adobe Reader 8.1.3 Adobe Reader 8.1.2 Adobe Reader 8.1.1 Adobe Reader 7.1.3 Adobe Reader 7.1.2 Adobe Reader 7.1.1 Adobe Reader 7.0.9 Adobe Reader 7.0.8 Adobe Reader 7.0.7 Adobe Reader 7.0.6 Adobe Reader 7.0.5 Adobe Reader 7.0.4 Adobe Reader 7.0.3 Adobe Reader 7.0.2 Adobe Reader 7.0.1 Adobe Reader 7.0 Adobe Reader 9.1 Adobe Reader 9 Adobe Reader 8.1.2 Security Updat Adobe Reader 8.1 Adobe Reader 8.0 Adobe Reader 7.1 Adobe Acrobat Standard 9.1.3 Adobe Acrobat Standard 9.1.2 Adobe Acrobat Standard 8.1.6 Adobe Acrobat Standard 8.1.4 Adobe Acrobat Standard 8.1.3 Adobe Acrobat Standard 8.1.2 Adobe Acrobat Standard 8.1.1 Adobe Acrobat Standard 7.1.3 Adobe Acrobat Standard 7.1.1 Adobe Acrobat Standard 7.0.8 Adobe Acrobat Standard 7.0.7 Adobe Acrobat Standard 7.0.6 Adobe Acrobat Standard 7.0.5 Adobe Acrobat Standard 7.0.4 Adobe Acrobat Standard 7.0.3 Adobe Acrobat Standard 7.0.2 Adobe Acrobat Standard 7.0.1 Adobe Acrobat Standard 7.0 Adobe Acrobat Standard 9.1 Adobe Acrobat Standard 9 Adobe Acrobat Standard 8.1 Adobe Acrobat Standard 8.0 Adobe Acrobat Standard 7.1 Adobe Acrobat Reader (UNIX) 7.0.1 Adobe Acrobat Reader (UNIX) 7.0 Adobe Acrobat Professional 9.1.3 Adobe Acrobat Professional 9.1.2 Adobe Acrobat Professional 8.1.6 Adobe Acrobat Professional 8.1.4 Adobe Acrobat Professional 8.1.3 Adobe Acrobat Professional 8.1.2 Adobe Acrobat Professional 8.1.1 Adobe Acrobat Professional 7.1.3 Adobe Acrobat Professional 7.1.1 Adobe Acrobat Professional 7.0.9 Adobe Acrobat Professional 7.0.8 Adobe Acrobat Professional 7.0.7 Adobe Acrobat Professional 7.0.6 Adobe Acrobat Professional 7.0.5 Adobe Acrobat Professional 7.0.4 Adobe Acrobat Professional 7.0.3 Adobe Acrobat Professional 7.0.2 Adobe Acrobat Professional 7.0.1 Adobe Acrobat Professional 7.0 Adobe Acrobat Professional 9.1 Adobe Acrobat Professional 9 Adobe Acrobat Professional 8.1.2 Security Updat Adobe Acrobat Professional 8.1 Adobe Acrobat Professional 8.0 Adobe Acrobat Professional 7.1 Adobe Acrobat 3D 8.1.3 Adobe Acrobat 3D 8.1.2 Adobe Acrobat 3D 0 Adobe Acrobat 9.1.1 Adobe Acrobat 7.0.3 Adobe Acrobat 7.0.2 Adobe Acrobat 7.0.1 Adobe Acrobat 7.0
Not Vulnerable:	Adobe Reader 8.1.7 Adobe Reader 7.1.4 Adobe Reader 9.2 Adobe Acrobat Standard 8.1.7 Adobe Acrobat Standard 7.1.4 Adobe Acrobat Standard 9.2 Adobe Acrobat Professional 8.1.7 Adobe Acrobat Professional 7.1.4 Adobe Acrobat Professional 9.2

Adobe Reader and Acrobat U3D File Invalid Array Index Remote Vulnerability

Adobe Reader and Acrobat are prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code. Failed exploit attempts will likely cause denial-of-service conditions.

This issue was previously covered in BID 36638 (Adobe Reader and Acrobat October 2009 Multiple Remote Vulnerabilities), but has been given its own record to better document it.

Adobe Reader and Acrobat U3D File Invalid Array Index Remote Vulnerability

The following exploits are available:

• /data/vulnerabilities/exploits/36665.py
• /data/vulnerabilities/exploits/36665.rb

Adobe Reader and Acrobat U3D File Invalid Array Index Remote Vulnerability

Solution:
Updates are available. Please see the references for details.


S.u.S.E. openSUSE 11.0

• S.u.S.E. acroread-8.1.7-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/acroread-8.1.7-0.1.i 586.rpm

S.u.S.E. openSUSE 11.1

• S.u.S.E. acroread-8.1.7-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/acroread-8.1.7-0.1.1 .i586.rpm

Adobe Reader and Acrobat U3D File Invalid Array Index Remote Vulnerability

References:

• Adobe Acrobat and Reader U3D File Invalid Array Index Vulnerability (iDefense Labs)
  
• Adobe Homepage (Adobe)
  
• iDefense Security Advisory 10.13.09: Adobe Acrobat and Reader U3D File Invalid A (iDefense Labs )
  
• APSB09-15 Security Advisory for Adobe Reader and Acrobat (Adobe)
  
• Multiple Security Vulnerabilities in Adobe Reader for Solaris 10 May Allow Execu (Sun)