NOS Microsystems getPlus Help ActiveX Control Stack Buffer Overflow Vulnerabilities

Bugtraq ID:	37759
Class:	Boundary Condition Error
CVE:	CVE-2009-3958
Remote:	Yes
Local:	No
Published:	Jan 12 2010 12:00AM
Updated:	Mar 19 2015 08:27AM
Credit:	Will Dormann
Vulnerable:	SuSE Suse Linux Enterprise Desktop 11 SuSE SUSE Linux Enterprise 10 SP3 SuSE SUSE Linux Enterprise 10 SP2 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 NOS Microsystems getPlus Helper ActiveX control 0 Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service Media Processing Server 0 Nortel Networks CallPilot 703t Nortel Networks CallPilot 600r Nortel Networks CallPilot 201i Nortel Networks CallPilot 200i Nortel Networks CallPilot 1005r Nortel Networks CallPilot 1002rp Adobe Reader 9.1.3 Adobe Reader 9.1.2 Adobe Reader 9.1.1 Adobe Reader 8.1.7 Adobe Reader 8.1.6 Adobe Reader 8.1.5 Adobe Reader 8.1.4 Adobe Reader 8.1.3 Adobe Reader 8.1.2 Adobe Reader 8.1.1 Adobe Reader 9.2 Adobe Reader 9.1 Adobe Reader 9.0 Adobe Reader 8.1.2 Security Updat Adobe Reader 8.1 Adobe Reader 8.0 Adobe Acrobat Standard 9.1.3 Adobe Acrobat Standard 9.1.2 Adobe Acrobat Standard 8.1.7 Adobe Acrobat Standard 8.1.6 Adobe Acrobat Standard 8.1.4 Adobe Acrobat Standard 8.1.3 Adobe Acrobat Standard 8.1.2 Adobe Acrobat Standard 8.1.1 Adobe Acrobat Standard 9.2 Adobe Acrobat Standard 9.1 Adobe Acrobat Standard 9 Adobe Acrobat Standard 8.1 Adobe Acrobat Standard 8.0 Adobe Acrobat Professional 9.1.3 Adobe Acrobat Professional 9.1.2 Adobe Acrobat Professional 8.1.7 Adobe Acrobat Professional 8.1.6 Adobe Acrobat Professional 8.1.4 Adobe Acrobat Professional 8.1.3 Adobe Acrobat Professional 8.1.2 Adobe Acrobat Professional 8.1.1 Adobe Acrobat Professional 9.2 Adobe Acrobat Professional 9.1 Adobe Acrobat Professional 9 Adobe Acrobat Professional 8.1.2 Security Updat Adobe Acrobat Professional 8.1 Adobe Acrobat Professional 8.0 Adobe Acrobat 9.1.1 Adobe Acrobat 9.2
Not Vulnerable:	NOS Microsystems getPlus Helper ActiveX control 1.6.2.49 Adobe Reader 9.3 Adobe Reader 8.2 Adobe Acrobat Standard 9.3 Adobe Acrobat Standard 8.2 Adobe Acrobat Professional 9.3 Adobe Acrobat Professional 8.2 Adobe Acrobat 9.3

NOS Microsystems getPlus Help ActiveX Control Stack Buffer Overflow Vulnerabilities

NOS Microsystems getPlus Helper ActiveX control is prone to multiple stack-based buffer-overflow vulnerabilities.

Successful exploits may allow the attacker to execute arbitrary code in the context of a user running the affected application. Failed attempts will likely result in denial-of-service conditions.

NOTE: This issue was previously covered in BID 37667 (Adobe Acrobat and Reader January 2010 Multiple Remote Vulnerabilities), but has been given its own record to better document it.

NOTE (January 13, 2010): This issue was previously titled 'Adobe Reader and Acrobat Download Manager Remote Code Execution Vulnerability', but has been renamed to properly identify the root vulnerable software.

NOS Microsystems getPlus Help ActiveX Control Stack Buffer Overflow Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NOS Microsystems getPlus Help ActiveX Control Stack Buffer Overflow Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


S.u.S.E. openSUSE 11.1

• S.u.S.E. acroread-9.3-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.2/rpm/i586/acroread-9.3-0.1.1.i 586.rpm

S.u.S.E. openSUSE 11.0

• S.u.S.E. acroread-9.3-0.1.i586.rpm
  http://download.opensuse.org/update/11.0/rpm/i586/acroread-9.3-0.1.i58 6.rpm

S.u.S.E. openSUSE 11.2

• S.u.S.E. acroread-9.3-0.1.1.i586.rpm
  http://download.opensuse.org/update/11.2/rpm/i586/acroread-9.3-0.1.1.i 586.rpm

NOS Microsystems getPlus Help ActiveX Control Stack Buffer Overflow Vulnerabilities

References:

• Adobe Homepage (Adobe)
  
• Avaya Enterprise (Fomerly Nortel Enterprise) Response to Adobe Security Bulletin (Nortel Networks)
  
• getPlus Download Manager Homepage (NOS Microsystems)
  
• APSB10-02 Security Advisory for Adobe Reader and Acrobat (Adobe)
  
• Vulnerability Note VU#773545 NOS Microsystems Adobe getPlus Helper ActiveX contr (US-CERT)