BID:41231

Adobe Acrobat and Reader CoolType Typography Engine Remote Denial of Service Vulnerability

Info

Adobe Acrobat and Reader CoolType Typography Engine Remote Denial of Service Vulnerability

Bugtraq ID:	41231
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2010-2204
Remote:	Yes
Local:	No
Published:	Jun 29 2010 12:00AM
Updated:	Mar 19 2015 09:15AM
Credit:	Gjoko 'LiquidWorm' Krstic &amp;amp;lt;br&amp;amp;gt;
Vulnerable:	SuSE SUSE Linux Enterprise Desktop 11 SP1 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Desktop 11 SuSE SUSE Linux Enterprise Desktop 10 SP3 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 RedHat Enterprise Linux WS Extras 4 RedHat Enterprise Linux Extras 4 RedHat Enterprise Linux ES Extras 4 RedHat Enterprise Linux AS Extras 4 RedHat Desktop Extras 4 Red Hat Enterprise Linux Supplementary 5 server Red Hat Enterprise Linux Desktop Supplementary 5 client Gentoo Linux Adobe Reader 9.3.2 Adobe Reader 9.3.1 Adobe Reader 9.1.3 Adobe Reader 9.1.2 Adobe Reader 9.1.1 Adobe Reader 8.2.2 Adobe Reader 8.2.1 Adobe Reader 8.1.7 Adobe Reader 8.1.6 Adobe Reader 8.1.5 Adobe Reader 8.1.4 Adobe Reader 8.1.3 Adobe Reader 8.1.2 Adobe Reader 8.1.1 Adobe Reader 7.1.4 Adobe Reader 7.1.3 Adobe Reader 7.1.2 Adobe Reader 7.1.1 Adobe Reader 7.0.9 Adobe Reader 7.0.8 Adobe Reader 7.0.7 Adobe Reader 7.0.6 Adobe Reader 7.0.5 Adobe Reader 7.0.4 Adobe Reader 7.0.3 Adobe Reader 7.0.2 Adobe Reader 7.0.1 Adobe Reader 7.0 Adobe Reader 9.3 Adobe Reader 9.2 Adobe Reader 9.1 Adobe Reader 9 Adobe Reader 8.2 Adobe Reader 8.1.2 Security Updat Adobe Reader 8.1 Adobe Reader 8.0 Adobe Reader 7.1 Adobe Acrobat Standard 9.3.2 Adobe Acrobat Standard 9.3.1 Adobe Acrobat Standard 9.1.3 Adobe Acrobat Standard 9.1.2 Adobe Acrobat Standard 8.2.2 Adobe Acrobat Standard 8.2.1 Adobe Acrobat Standard 8.1.7 Adobe Acrobat Standard 8.1.6 Adobe Acrobat Standard 8.1.4 Adobe Acrobat Standard 8.1.3 Adobe Acrobat Standard 8.1.2 Adobe Acrobat Standard 8.1.1 Adobe Acrobat Standard 7.1.4 Adobe Acrobat Standard 7.1.3 Adobe Acrobat Standard 7.1.1 Adobe Acrobat Standard 7.0.8 Adobe Acrobat Standard 7.0.7 Adobe Acrobat Standard 7.0.6 Adobe Acrobat Standard 7.0.5 Adobe Acrobat Standard 7.0.4 Adobe Acrobat Standard 7.0.3 Adobe Acrobat Standard 7.0.2 Adobe Acrobat Standard 7.0.1 Adobe Acrobat Standard 7.0 Adobe Acrobat Standard 9.3 Adobe Acrobat Standard 9.2 Adobe Acrobat Standard 9.1 Adobe Acrobat Standard 9 Adobe Acrobat Standard 8.2 Adobe Acrobat Standard 8.1 Adobe Acrobat Standard 8.0 Adobe Acrobat Standard 7.1 Adobe Acrobat Professional 9.3.2 Adobe Acrobat Professional 9.3.1 Adobe Acrobat Professional 9.1.3 Adobe Acrobat Professional 9.1.2 Adobe Acrobat Professional 8.2.2 Adobe Acrobat Professional 8.2.1 Adobe Acrobat Professional 8.1.7 Adobe Acrobat Professional 8.1.6 Adobe Acrobat Professional 8.1.4 Adobe Acrobat Professional 8.1.3 Adobe Acrobat Professional 8.1.2 Adobe Acrobat Professional 8.1.1 Adobe Acrobat Professional 7.1.4 Adobe Acrobat Professional 7.1.3 Adobe Acrobat Professional 7.1.1 Adobe Acrobat Professional 7.0.9 Adobe Acrobat Professional 7.0.8 Adobe Acrobat Professional 7.0.7 Adobe Acrobat Professional 7.0.6 Adobe Acrobat Professional 7.0.5 Adobe Acrobat Professional 7.0.4 Adobe Acrobat Professional 7.0.3 Adobe Acrobat Professional 7.0.2 Adobe Acrobat Professional 7.0.1 Adobe Acrobat Professional 7.0 Adobe Acrobat Professional 9.3 Adobe Acrobat Professional 9.2 Adobe Acrobat Professional 9.1 Adobe Acrobat Professional 9 Adobe Acrobat Professional 8.2 Adobe Acrobat Professional 8.1.2 Security Updat Adobe Acrobat Professional 8.1 Adobe Acrobat Professional 8.0 Adobe Acrobat Professional 7.1 Adobe Acrobat Professional 6.0 Adobe Acrobat 9.3.2 Adobe Acrobat 9.3.1 Adobe Acrobat 9.1.1 Adobe Acrobat 8.2.2 Adobe Acrobat 7.0.9 Adobe Acrobat 7.0.3 Adobe Acrobat 7.0.2 Adobe Acrobat 7.0.1 Adobe Acrobat 7.0 Adobe Acrobat 6.0.5 Adobe Acrobat 6.0.4 Adobe Acrobat 6.0.3 Adobe Acrobat 6.0.2 Adobe Acrobat 6.0.1 Adobe Acrobat 6.0 Adobe Acrobat 9.3 Adobe Acrobat 9.2

Not Vulnerable:	Adobe Reader 9.3.3 Adobe Acrobat Standard 9.3.3 Adobe Acrobat Professional 9.3.3 Adobe Acrobat 9.3.3

Discussion

Adobe Acrobat and Reader CoolType Typography Engine Remote Denial of Service Vulnerability

Adobe Acrobat and Reader are prone to a denial-of-service vulnerability due to a memory-corruption issue.

Attackers can exploit this issue to crash the affected application, denying service to legitimate users. Due to the nature of this issue, arbitrary code-execution may be possible; however this has not been confirmed.

Adobe Reader and Acrobat versions prior to and including 9.3.2 and 8.2.2 are affected.

NOTE: This issue was previously covered in BID 41130 (Adobe Acrobat and Reader Prior to 9.3.3 Multiple Remote Vulnerabilities) but has been given its own record to better document it.

Exploit / POC

Adobe Acrobat and Reader CoolType Typography Engine Remote Denial of Service Vulnerability

The following example is available:

/data/vulnerabilities/exploits/41231.c

Solution / Fix

Adobe Acrobat and Reader CoolType Typography Engine Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.

S.u.S.E. openSUSE 11.0