Executive Summary

Informations
NameCVE-2009-2564First vendor Publication2009-07-21
VendorCveLast vendor Modification2010-12-01

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score7.2Attack RangeLocal
Cvss Impact Score10Attack ComplexityLow
Cvss Expoit Score3.9AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Security Protection

ImpactsProvides administrator access : Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service.

Detail

NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2564

CWE : Common Weakness Enumeration

%idName
100 %CWE-264Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:5719
 
Oval ID: oval:org.mitre.oval:def:5719
Title: Adobe Reader and Acrobat getPlus_HelperSvc.exe) local elevation of privileges
Description: NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.
Family: windows Class: vulnerability
Reference(s): CVE-2009-2564
Version: 16
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Microsoft Windows 7
Product(s): Adobe Reader
Adobe Acrobat
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application2
Application1
Application1

Milw0rm Exploits

idDescription
2009-07-20Adobe related service (getPlus_HelperSvc.exe) Local Privilege Escalation

OpenVAS Exploits

DateDescription
2009-10-27Name : SuSE Security Advisory SUSE-SA:2009:049 (acroread, acroread_ja)
File : nvt/suse_sa_2009_049.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
56120Adobe getPlus DLM \NOS\bin\getPlus_HelperSvc.exe Permission Weakness Local Pr...

Nessus® Vulnerability Scanner

DateDescription
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_acroread-6582.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_acroread-6583.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_acroread_ja-6584.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_acroread_ja-6585.nasl - Type : ACT_GATHER_INFO
2009-10-30Name : The remote openSUSE host is missing a security update.
File : suse_acroread-6588.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote openSUSE host is missing a security update.
File : suse_11_0_acroread-091022.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote SuSE 11 host is missing a security update.
File : suse_11_acroread-091022.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote SuSE 11 host is missing a security update.
File : suse_11_acroread_ja-091022.nasl - Type : ACT_GATHER_INFO
2009-10-26Name : The remote openSUSE host is missing a security update.
File : suse_11_1_acroread-091022.nasl - Type : ACT_GATHER_INFO
2009-10-14Name : The PDF file viewer on the remote Windows host is affected by a memory corrup...
File : adobe_reader_apsb09-15.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

SourceUrl
BID http://www.securityfocus.com/bid/35740
BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/505095/100/0/threaded
CERT http://www.us-cert.gov/cas/techalerts/TA09-286B.html
CONFIRM http://blogs.adobe.com/psirt/2009/07/local_privilege_escalation_in.html
http://www.adobe.com/support/security/bulletins/apsb09-15.html
MILW0RM http://www.milw0rm.com/exploits/9199
MISC http://retrogod.altervista.org/9sg_adobe_local.html
SECTRACK http://securitytracker.com/id?1023007
VUPEN http://www.vupen.com/english/advisories/2009/1969
http://www.vupen.com/english/advisories/2009/2898
XF http://xforce.iss.net/xforce/xfdb/54383

Alert History

If you want to see full details history, please login or register.
0
1
2
DateInformations
2016-04-26 18:59:23
  • Multiple Updates
2014-02-17 10:50:56
  • Multiple Updates
2013-05-10 23:54:20
  • Multiple Updates