Adobe Reader and Acrobat 'newplayer()' JavaScript Method Remote Code Execution Vulnerability
BID:37331
Info
Adobe Reader and Acrobat 'newplayer()' JavaScript Method Remote Code Execution Vulnerability
| Bugtraq ID: | 37331 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2009-4324 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 14 2009 12:00AM |
| Updated: | Sep 07 2010 09:12PM |
| Credit: | This issue was discovered in the wild. |
| Vulnerable: |
SuSE Suse Linux Enterprise Desktop 11 SuSE SUSE Linux Enterprise 10 SP3 SuSE SUSE Linux Enterprise 10 SP2 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 Redhat Enterprise Linux WS Extras 4 Redhat Enterprise Linux WS Extras 3 Redhat Enterprise Linux Supplementary 5 server Redhat Enterprise Linux Extras 4 Redhat Enterprise Linux Extras 3 Redhat Enterprise Linux ES Extras 4 Redhat Enterprise Linux ES Extras 3 Redhat Enterprise Linux Desktop Supplementary 5 client Redhat Enterprise Linux AS Extras 4 Redhat Enterprise Linux AS Extras 3 Redhat Desktop Extras 4 Redhat Desktop Extras 3 Gentoo Linux Adobe Reader 9.1.3 Adobe Reader 9.1.2 Adobe Reader 9.1.1 Adobe Reader 8.1.7 Adobe Reader 8.1.6 Adobe Reader 8.1.5 Adobe Reader 8.1.4 Adobe Reader 8.1.3 Adobe Reader 8.1.2 Adobe Reader 8.1.1 Adobe Reader 7.0.9 Adobe Reader 6.0.1 Adobe Reader 9.2 Adobe Reader 9.1 Adobe Reader 9.0 Adobe Reader 8.1 Adobe Reader 8.0 Adobe Acrobat Standard 9.1.3 Adobe Acrobat Standard 9.1.2 Adobe Acrobat Standard 8.1.7 Adobe Acrobat Standard 8.1.6 Adobe Acrobat Standard 8.1.4 Adobe Acrobat Standard 8.1.3 Adobe Acrobat Standard 8.1.2 Adobe Acrobat Standard 8.1.1 Adobe Acrobat Standard 9.2 Adobe Acrobat Standard 9.1 Adobe Acrobat Standard 9 Adobe Acrobat Standard 8.1 Adobe Acrobat Standard 8.0 Adobe Acrobat Professional 9.1.3 Adobe Acrobat Professional 9.1.2 Adobe Acrobat Professional 8.1.7 Adobe Acrobat Professional 8.1.6 Adobe Acrobat Professional 8.1.4 Adobe Acrobat Professional 8.1.3 Adobe Acrobat Professional 8.1.2 Adobe Acrobat Professional 8.1.1 Adobe Acrobat Professional 9.2 Adobe Acrobat Professional 9.1 Adobe Acrobat Professional 9 Adobe Acrobat Professional 8.1 Adobe Acrobat Professional 8.0 Adobe Acrobat 9.1.1 Adobe Acrobat 7.0.9 Adobe Acrobat 6.0.1 Adobe Acrobat 9.2 |
| Not Vulnerable: |
Adobe Reader 9.3 Adobe Reader 8.2 Adobe Acrobat Standard 9.3 Adobe Acrobat Standard 8.2 Adobe Acrobat Professional 9.3 Adobe Acrobat Professional 8.2 Adobe Acrobat 9.3 |
Discussion
Adobe Reader and Acrobat 'newplayer()' JavaScript Method Remote Code Execution Vulnerability
Adobe Reader and Acrobat are prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code. Failed exploit attempts will likely cause denial-of-service conditions.
This issue affects Reader and Acrobat 9.2 and prior versions.
Adobe Reader and Acrobat are prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code. Failed exploit attempts will likely cause denial-of-service conditions.
This issue affects Reader and Acrobat 9.2 and prior versions.
Exploit / POC
Adobe Reader and Acrobat 'newplayer()' JavaScript Method Remote Code Execution Vulnerability
The issue is being exploited in the wild. Symantec products detect this malicious PDF file as Trojan.Pidief.H.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
A working commercial exploit is available through VUPEN's Exploit and PoC Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following exploit code is available:
The issue is being exploited in the wild. Symantec products detect this malicious PDF file as Trojan.Pidief.H.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
A working commercial exploit is available through VUPEN's Exploit and PoC Service. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following exploit code is available:
Solution / Fix
Adobe Reader and Acrobat 'newplayer()' JavaScript Method Remote Code Execution Vulnerability
Solution:
Updates are available. Please see the references for more information.
S.u.S.E. openSUSE 11.0
S.u.S.E. openSUSE 11.1
S.u.S.E. openSUSE 11.2
Solution:
Updates are available. Please see the references for more information.
S.u.S.E. openSUSE 11.0
-
S.u.S.E. acroread-9.3-0.1.i586.rpm
http://download.opensuse.org/update/11.0/rpm/i586/acroread-9.3-0.1.i58 6.rpm
S.u.S.E. openSUSE 11.1
-
S.u.S.E. acroread-9.3-0.1.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/acroread-9.3-0.1.1.i 586.rpm
S.u.S.E. openSUSE 11.2
-
S.u.S.E. acroread-9.3-0.1.1.i586.rpm
http://download.opensuse.org/update/11.2/rpm/i586/acroread-9.3-0.1.1.i 586.rpm
References
Adobe Reader and Acrobat 'newplayer()' JavaScript Method Remote Code Execution Vulnerability
References:
References:
- Adobe Homepage (Adobe)
- Adobe Reader and Acrobat JavaScript Blacklist Framwork Mitigation (Adobe)
- New Adobe Reader and Acrobat Vulnerability (Adobe)
- Trojan.Pidief.H (Symantec)
- US-CERT Vulnerability Note VU#508357 (US-CERT)
- APSA09-07 - Security Advisory for Adobe Reader and Acrobat (Adobe)
- APSB10-02 Security Advisory for Adobe Reader and Acrobat (Adobe)