Adobe Acrobat Image Decoder Remote Code Execution Vulnerability

Bugtraq ID:	36691
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2009-2984
Remote:	Yes
Local:	No
Published:	Oct 13 2009 12:00AM
Updated:	Oct 26 2009 09:38PM
Credit:	Tavis Ormandy, Google Security Team
Vulnerable:	Sun Solaris 10.0 Gentoo Linux Adobe Acrobat Standard 9.1.3 Adobe Acrobat Standard 9.1.2 Adobe Acrobat Standard 9.1 Adobe Acrobat Standard 9 Adobe Acrobat Professional 9.1.3 Adobe Acrobat Professional 9.1.2 Adobe Acrobat Professional 9.1 Adobe Acrobat Professional 9 Adobe Acrobat 9.1.1
Not Vulnerable:	Adobe Acrobat Standard 9.2 Adobe Acrobat Professional 9.2

Adobe Acrobat Image Decoder Remote Code Execution Vulnerability

Adobe Acrobat is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will cause denial-of-service conditions.

Versions *prior to* Acrobat 9.2 are affected.

This issue was previously covered in BID 36638 (Adobe Reader and Acrobat October 2009 Multiple Remote Vulnerabilities), but has been given its own record to better document it.

Adobe Acrobat Image Decoder Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Adobe Acrobat Image Decoder Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for details.

Adobe Acrobat Image Decoder Remote Code Execution Vulnerability

References:

• Adobe Homepage (Adobe)
  
• APSB09-15 Security Updates Available for Adobe Reader and Acrobat (Adobe)
  
• Multiple Security Vulnerabilities in Adobe Reader for Solaris 10 May Allow Execu (Sun)