Adobe Acrobat and Reader CVE-2011-0604 Cross Site Scripting Vulnerability

Bugtraq ID:	46217
Class:	Input Validation Error
CVE:	CVE-2011-0604
Remote:	Yes
Local:	No
Published:	Feb 08 2011 12:00AM
Updated:	Mar 19 2015 09:09AM
Credit:	Billy Rios from the Google Security Team
Vulnerable:	SuSE SUSE Linux Enterprise Desktop 11 SP1 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Desktop 10 SP3 SuSE openSUSE 11.3 S.u.S.E. openSUSE 11.2 RedHat Enterprise Linux WS Extras 4 RedHat Enterprise Linux Extras 4 RedHat Enterprise Linux ES Extras 4 RedHat Enterprise Linux AS Extras 4 RedHat Desktop Extras 4 Red Hat Enterprise Linux Workstation Supplementary 6 Red Hat Enterprise Linux Supplementary 5 server Red Hat Enterprise Linux Server Supplementary 6 Red Hat Enterprise Linux Desktop Supplementary 6 Red Hat Enterprise Linux Desktop Supplementary 5 client Gentoo Linux Adobe Reader 9.3.4 Adobe Reader 9.3.3 Adobe Reader 9.3.2 Adobe Reader 9.3.1 Adobe Reader 9.1.3 Adobe Reader 9.1.2 Adobe Reader 9.1.1 Adobe Reader 8.2.3 Adobe Reader 8.2.2 Adobe Reader 8.2.1 Adobe Reader 8.1.7 Adobe Reader 8.1.6 Adobe Reader 8.1.5 Adobe Reader 8.1.4 Adobe Reader 8.1.2 Adobe Reader 8.1.1 Adobe Reader 9.4.1 Adobe Reader 9.4 Adobe Reader 9.3 Adobe Reader 9.2 Adobe Reader 9.1 Adobe Reader 9 Adobe Reader 8.2 Adobe Reader 8.1 Adobe Reader 8.0 Adobe Reader 10.0 Adobe Acrobat Standard 9.3.4 Adobe Acrobat Standard 9.3.3 Adobe Acrobat Standard 9.3.2 Adobe Acrobat Standard 9.3.1 Adobe Acrobat Standard 9.1.3 Adobe Acrobat Standard 9.1.2 Adobe Acrobat Standard 8.2.5 Adobe Acrobat Standard 8.2.4 Adobe Acrobat Standard 8.2.2 Adobe Acrobat Standard 8.2.1 Adobe Acrobat Standard 8.1.7 Adobe Acrobat Standard 8.1.6 Adobe Acrobat Standard 8.1.4 Adobe Acrobat Standard 8.1.3 Adobe Acrobat Standard 8.1.2 Adobe Acrobat Standard 8.1.1 Adobe Acrobat Standard 7.1.4 Adobe Acrobat Standard 7.1.3 Adobe Acrobat Standard 7.1.1 Adobe Acrobat Standard 7.0.8 Adobe Acrobat Standard 7.0.7 Adobe Acrobat Standard 7.0.6 Adobe Acrobat Standard 7.0.5 Adobe Acrobat Standard 7.0.4 Adobe Acrobat Standard 7.0.3 Adobe Acrobat Standard 7.0.2 Adobe Acrobat Standard 7.0.1 Adobe Acrobat Standard 7.0 Adobe Acrobat Standard 9.4.1 Adobe Acrobat Standard 9.4 Adobe Acrobat Standard 9.3 Adobe Acrobat Standard 9.2 Adobe Acrobat Standard 9.1 Adobe Acrobat Standard 9 Adobe Acrobat Standard 8.2 Adobe Acrobat Standard 8.1 Adobe Acrobat Standard 8.0 Adobe Acrobat Standard 7.1 Adobe Acrobat Standard 10.0 Adobe Acrobat Reader (for Linux) 9.3.3 Adobe Acrobat Reader (for Linux) 8.2.4 Adobe Acrobat Professional 9.3.4 Adobe Acrobat Professional 9.3.3 Adobe Acrobat Professional 9.3.2 Adobe Acrobat Professional 9.3.1 Adobe Acrobat Professional 9.1.3 Adobe Acrobat Professional 9.1.2 Adobe Acrobat Professional 8.2.5 Adobe Acrobat Professional 8.2.4 Adobe Acrobat Professional 8.2.2 Adobe Acrobat Professional 8.2.1 Adobe Acrobat Professional 8.1.7 Adobe Acrobat Professional 8.1.6 Adobe Acrobat Professional 8.1.4 Adobe Acrobat Professional 8.1.3 Adobe Acrobat Professional 8.1.2 Adobe Acrobat Professional 8.1.1 Adobe Acrobat Professional 7.1.4 Adobe Acrobat Professional 7.1.3 Adobe Acrobat Professional 7.1.1 Adobe Acrobat Professional 7.0.9 Adobe Acrobat Professional 7.0.8 Adobe Acrobat Professional 7.0.7 Adobe Acrobat Professional 7.0.6 Adobe Acrobat Professional 7.0.5 Adobe Acrobat Professional 7.0.4 Adobe Acrobat Professional 7.0.3 Adobe Acrobat Professional 7.0.2 Adobe Acrobat Professional 7.0.1 Adobe Acrobat Professional 7.0 Adobe Acrobat Professional 9.4.1 Adobe Acrobat Professional 9.4 Adobe Acrobat Professional 9.3 Adobe Acrobat Professional 9.2 Adobe Acrobat Professional 9.1 Adobe Acrobat Professional 9 Extended Adobe Acrobat Professional 9 Adobe Acrobat Professional 8.2 Adobe Acrobat Professional 8.1 Adobe Acrobat Professional 8.0 Adobe Acrobat Professional 7.1 Adobe Acrobat Professional 6.0 Adobe Acrobat Professional 10.0 Adobe Acrobat 9.3.3 Adobe Acrobat 9.3.2 Adobe Acrobat 9.3.1 Adobe Acrobat 9.1.1 Adobe Acrobat 8.2.4 Adobe Acrobat 8.2.4 Adobe Acrobat 8.2.3 Adobe Acrobat 8.2.2 Adobe Acrobat 8.1.8 Adobe Acrobat 9.4.1 Adobe Acrobat 9.4 Adobe Acrobat 9.3 Adobe Acrobat 9.2 Adobe Acrobat 10.0
Not Vulnerable:	Adobe Reader 9.4.2 Adobe Reader 10.0.1 Adobe Acrobat Standard 9.4.2 Adobe Acrobat Standard 10.0.1 Adobe Acrobat Professional 9.4.2 Adobe Acrobat Professional 10.0.1 Adobe Acrobat 9.4.2 Adobe Acrobat 10.0.1

Adobe Acrobat and Reader CVE-2011-0604 Cross Site Scripting Vulnerability

Adobe Acrobat and Reader are prone to an unspecified cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Adobe Reader and Acrobat versions prior to 9.4.2 and 10.0.1 are affected.

Adobe Acrobat and Reader CVE-2011-0604 Cross Site Scripting Vulnerability

An attacker can exploit this issue by tricking an unsuspecting victim into following a malicious URI.

Adobe Acrobat and Reader CVE-2011-0604 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.


S.u.S.E. openSUSE 11.2

• SuSE acroread-9.4.2-0.2.1.i586.rpm
  http://download.opensuse.org/update/11.3/rpm/i586/acroread-9.4.2-0.2.1 .i586.rpm


• SuSE acroread-cmaps-9.4.2-0.2.1.noarch.rpm
  http://download.opensuse.org/update/11.2/rpm/noarch/acroread-cmaps-9.4 .2-0.2.1.noarch.rpm


• SuSE acroread-fonts-ja-9.4.2-0.2.1.noarch.rpm
  http://download.opensuse.org/update/11.2/rpm/noarch/acroread-fonts-ja- 9.4.2-0.2.1.noarch.rpm


• SuSE acroread-fonts-ko-9.4.2-0.2.1.noarch.rpm
  http://download.opensuse.org/update/11.2/rpm/noarch/acroread-fonts-ko- 9.4.2-0.2.1.noarch.rpm


• SuSE acroread-fonts-zh_CN-9.4.2-0.2.1.noarch.rpm
  http://download.opensuse.org/update/11.2/rpm/noarch/acroread-fonts-zh_ CN-9.4.2-0.2.1.noarch.rpm


• SuSE acroread-fonts-zh_TW-9.4.2-0.2.1.noarch.rpm
  http://download.opensuse.org/update/11.2/rpm/noarch/acroread-fonts-zh_ TW-9.4.2-0.2.1.noarch.rpm

Adobe Acrobat and Reader CVE-2011-0604 Cross Site Scripting Vulnerability

References:

• Adobe Homepage (Adobe)
  
• APSB11-03 Security updates available for Adobe Reader and Acrobat (Adobe)