Executive Summary

Informations
Name CVE-2009-2564 First vendor Publication 2009-07-21
Vendor Cve Last vendor Modification 2010-12-01

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 7.2 Attack Range Local
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 3.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Security Protection

Impacts Provides administrator access : Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service.

Detail

NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2564

CWE : Common Weakness Enumeration

idName
CWE-264Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:5719
 
Oval ID: oval:org.mitre.oval:def:5719
Title: Adobe Reader and Acrobat getPlus_HelperSvc.exe) local elevation of privileges
Description: NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.
Family: windows Class: vulnerability
Reference(s): CVE-2009-2564
Version: 16
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows 7
Product(s): Adobe Reader
Adobe Acrobat
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application2
Application1
Application1

Milw0rm Exploits

idDescription
2009-07-20Adobe related service (getPlus_HelperSvc.exe) Local Privilege Escalation

OpenVAS Exploits

DateDescription
2009-10-27Name : SuSE Security Advisory SUSE-SA:2009:049 (acroread, acroread_ja)
File : nvt/suse_sa_2009_049.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
56120Adobe getPlus DLM \NOS\bin\getPlus_HelperSvc.exe Permission Weakness Local Pr...

Nessus® Vulnerability Scanner

DateDescription
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_acroread-6582.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_acroread-6583.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_acroread_ja-6584.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_acroread_ja-6585.nasl - Type : ACT_GATHER_INFO
2009-10-30Name : The remote openSUSE host is missing a security update.
File : suse_acroread-6588.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote openSUSE host is missing a security update.
File : suse_11_0_acroread-091022.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote SuSE 11 host is missing a security update.
File : suse_11_acroread-091022.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote SuSE 11 host is missing a security update.
File : suse_11_acroread_ja-091022.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote openSUSE host is missing a security update.
File : suse_11_1_acroread-091022.nasl - Type : ACT_GATHER_INFO
2009-10-14Name : The PDF file viewer on the remote Windows host is affected by a memory corrup...
File : adobe_reader_apsb09-15.nasl - Type : ACT_GATHER_INFO

Internal Sources (Detail)

SourceUrl
BID http://www.securityfocus.com/bid/35740
BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/505095/100/0/threaded
CERT http://www.us-cert.gov/cas/techalerts/TA09-286B.html
CONFIRM http://blogs.adobe.com/psirt/2009/07/local_privilege_escalation_in.html
http://www.adobe.com/support/security/bulletins/apsb09-15.html
MILW0RM http://www.milw0rm.com/exploits/9199
MISC http://retrogod.altervista.org/9sg_adobe_local.html
SECTRACK http://securitytracker.com/id?1023007
SECUNIA http://secunia.com/advisories/35930
http://secunia.com/advisories/36331
VUPEN http://www.vupen.com/english/advisories/2009/1969
http://www.vupen.com/english/advisories/2009/2898
XF http://xforce.iss.net/xforce/xfdb/54383

Alert History

If you want to see full details history, please login or register.
0
1
DateInformations
2014-02-17 10:50:56
  • Multiple Updates
2013-05-10 23:54:20
  • Multiple Updates