Executive Summary

Informations
NameCVE-2009-2564First vendor Publication2009-07-21
VendorCveLast vendor Modification2010-12-01

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score7.2Attack RangeLocal
Cvss Impact Score10Attack ComplexityLow
Cvss Expoit Score3.9AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Security Protection

ImpactsProvides administrator access : Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service.

Detail

NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2564

CWE : Common Weakness Enumeration

idName
CWE-264Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:5719
 
Oval ID: oval:org.mitre.oval:def:5719
Title: Adobe Reader and Acrobat getPlus_HelperSvc.exe) local elevation of privileges
Description: NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.
Family: windows Class: vulnerability
Reference(s): CVE-2009-2564
Version: 16
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows 7
Product(s): Adobe Reader
Adobe Acrobat
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application2
Application1
Application1

Milw0rm Exploits

idDescription
2009-07-20Adobe related service (getPlus_HelperSvc.exe) Local Privilege Escalation

OpenVAS Exploits

DateDescription
2009-10-27Name : SuSE Security Advisory SUSE-SA:2009:049 (acroread, acroread_ja)
File : nvt/suse_sa_2009_049.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
56120Adobe getPlus DLM \NOS\bin\getPlus_HelperSvc.exe Permission Weakness Local Pr...

Nessus® Vulnerability Scanner

DateDescription
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_acroread-6582.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_acroread-6583.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_acroread_ja-6584.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_acroread_ja-6585.nasl - Type : ACT_GATHER_INFO
2009-10-30Name : The remote openSUSE host is missing a security update.
File : suse_acroread-6588.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote openSUSE host is missing a security update.
File : suse_11_0_acroread-091022.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote SuSE 11 host is missing a security update.
File : suse_11_acroread-091022.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote SuSE 11 host is missing a security update.
File : suse_11_acroread_ja-091022.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote openSUSE host is missing a security update.
File : suse_11_1_acroread-091022.nasl - Type : ACT_GATHER_INFO
2009-10-14Name : The PDF file viewer on the remote Windows host is affected by a memory corrup...
File : adobe_reader_apsb09-15.nasl - Type : ACT_GATHER_INFO

Internal Sources (Detail)

SourceUrl
BIDhttp://www.securityfocus.com/bid/35740
BUGTRAQhttp://www.securityfocus.com/archive/1/archive/1/505095/100/0/threaded
CERThttp://www.us-cert.gov/cas/techalerts/TA09-286B.html
CONFIRMhttp://blogs.adobe.com/psirt/2009/07/local_privilege_escalation_in.html
http://www.adobe.com/support/security/bulletins/apsb09-15.html
MILW0RMhttp://www.milw0rm.com/exploits/9199
MISChttp://retrogod.altervista.org/9sg_adobe_local.html
SECTRACKhttp://securitytracker.com/id?1023007
SECUNIAhttp://secunia.com/advisories/35930
http://secunia.com/advisories/36331
VUPENhttp://www.vupen.com/english/advisories/2009/1969
http://www.vupen.com/english/advisories/2009/2898
XFhttp://xforce.iss.net/xforce/xfdb/54383

Alert History

If you want to see full details history, please login or register.
0
1
DateInformations
2014-02-17 10:50:56
  • Multiple Updates
2013-05-10 23:54:20
  • Multiple Updates