Adobe Reader and Acrobat COM Objects Memory Corruption Remote Code Execution Vulnerability

Bugtraq ID:	36668
Class:	Unknown
CVE:	CVE-2009-2983
Remote:	Yes
Local:	No
Published:	Oct 13 2009 12:00AM
Updated:	Oct 26 2009 10:18PM
Credit:	SkyLined of Google Inc.
Vulnerable:	SuSE Suse Linux Enterprise Desktop 11 SuSE Suse Linux Enterprise Desktop 10 SP3 SuSE Suse Linux Enterprise Desktop 10 SP2 Sun Solaris 10.0 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 Redhat Enterprise Linux WS Extras 4 Redhat Enterprise Linux WS Extras 3 Redhat Enterprise Linux Supplementary 5 server Redhat Enterprise Linux Extras 4 Redhat Enterprise Linux Extras 3 Redhat Enterprise Linux ES Extras 4 Redhat Enterprise Linux ES Extras 3 Redhat Enterprise Linux Desktop Supplementary 5 client Redhat Enterprise Linux AS Extras 4 Redhat Enterprise Linux AS Extras 3 Redhat Desktop Extras 4 Redhat Desktop Extras 3 Gentoo Linux Adobe Reader 9.1.3 Adobe Reader 9.1.2 Adobe Reader 9.1.1 Adobe Reader 8.1.6 Adobe Reader 8.1.5 Adobe Reader 8.1.4 Adobe Reader 8.1.3 Adobe Reader 8.1.2 Adobe Reader 8.1.1 Adobe Reader 7.1.2 Adobe Reader 7.1.1 Adobe Reader 7.0.9 Adobe Reader 7.0.9 Adobe Reader 7.0.8 Adobe Reader 7.0.8 Adobe Reader 7.0.7 Adobe Reader 7.0.6 Adobe Reader 7.0.5 Adobe Reader 7.0.4 Adobe Reader 7.0.3 Adobe Reader 7.0.2 Adobe Reader 7.0.1 Adobe Reader 7.0 Adobe Reader 9.1 Adobe Reader 9.0 Adobe Reader 8.1.2 Security Updat Adobe Reader 8.1 Adobe Reader 8.0 Adobe Reader 7.1 Adobe Acrobat Standard 9.1.3 Adobe Acrobat Standard 9.1.2 Adobe Acrobat Standard 8.1.6 Adobe Acrobat Standard 8.1.4 Adobe Acrobat Standard 8.1.3 Adobe Acrobat Standard 8.1.2 Adobe Acrobat Standard 8.1.1 Adobe Acrobat Standard 7.1.3 Adobe Acrobat Standard 7.1.1 Adobe Acrobat Standard 7.0.8 Adobe Acrobat Standard 7.0.7 Adobe Acrobat Standard 7.0.6 Adobe Acrobat Standard 7.0.5 Adobe Acrobat Standard 7.0.4 Adobe Acrobat Standard 7.0.3 Adobe Acrobat Standard 7.0.2 Adobe Acrobat Standard 7.0.1 Adobe Acrobat Standard 7.0 Adobe Acrobat Standard 9.1 Adobe Acrobat Standard 9 Adobe Acrobat Standard 8.1 Adobe Acrobat Standard 8.0 Adobe Acrobat Standard 7.1 Adobe Acrobat Professional 9.1.3 Adobe Acrobat Professional 9.1.2 Adobe Acrobat Professional 8.1.6 Adobe Acrobat Professional 8.1.4 Adobe Acrobat Professional 8.1.3 Adobe Acrobat Professional 8.1.2 Adobe Acrobat Professional 8.1.1 Adobe Acrobat Professional 7.1.3 Adobe Acrobat Professional 7.1.1 Adobe Acrobat Professional 7.0.9 Adobe Acrobat Professional 7.0.8 Adobe Acrobat Professional 7.0.7 Adobe Acrobat Professional 7.0.6 Adobe Acrobat Professional 7.0.5 Adobe Acrobat Professional 7.0.4 Adobe Acrobat Professional 7.0.3 Adobe Acrobat Professional 7.0.2 Adobe Acrobat Professional 7.0.1 Adobe Acrobat Professional 7.0 Adobe Acrobat Professional 9.1 Adobe Acrobat Professional 9 Adobe Acrobat Professional 8.1.2 Security Updat Adobe Acrobat Professional 8.1 Adobe Acrobat Professional 8.0 Adobe Acrobat Professional 7.1 Adobe Acrobat 9.1.1 Adobe Acrobat 7.0.3 Adobe Acrobat 7.0.2 Adobe Acrobat 7.0.1 Adobe Acrobat 7.0
Not Vulnerable:	Adobe Reader 8.1.7 Adobe Reader 7.1.4 Adobe Reader 9.2 Adobe Acrobat Standard 8.1.7 Adobe Acrobat Standard 7.1.4 Adobe Acrobat Standard 9.2 Adobe Acrobat Professional 8.1.7 Adobe Acrobat Professional 7.1.4 Adobe Acrobat Professional 9.2

Adobe Reader and Acrobat COM Objects Memory Corruption Remote Code Execution Vulnerability

Adobe Reader and Acrobat are prone to a remote code-execution vulnerability because they fail to properly handle certain COM objects.

An attacker can exploit this issue by supplying a malicious PDF file or webpage. Successful exploits may allow the attacker to execute arbitrary code in the context of a user running the affected application. Failed attempts will likely result in denial-of-service conditions.

This issue was previously covered in BID 36638 (Adobe Reader and Acrobat October 2009 Multiple Remote Vulnerabilities), but has been given its own record to better document it.

Adobe Reader and Acrobat COM Objects Memory Corruption Remote Code Execution Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user into visiting a malicious webpage or opening a specially crafted PDF file.

The following proof-of-concept files are available:

• /data/vulnerabilities/exploits/36668.tar

Adobe Reader and Acrobat COM Objects Memory Corruption Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.


S.u.S.E. openSUSE 11.0

• S.u.S.E. acroread-8.1.7-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/acroread-8.1.7-0.1.i 586.rpm

S.u.S.E. openSUSE 10.3

• S.u.S.E. acroread-8.1.7-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/acroread-8.1.7-0.1.i 586.rpm

S.u.S.E. openSUSE 11.1

• S.u.S.E. acroread-8.1.7-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.1/rpm/i586/acroread-8.1.7-0.1.1 .i586.rpm

Adobe Reader and Acrobat COM Objects Memory Corruption Remote Code Execution Vulnerability

References:

• Adobe Homepage (Adobe)
  
• Memory corruption when loading/unloading Adobe objects through EMBED tag in Fire (SkyLined)
  
• APSB09-15 Security Updates Available for Adobe Reader and Acrobat (Adobe)
  
• Multiple Security Vulnerabilities in Adobe Reader for Solaris 10 May Allow Execu (Sun)