RHSA-2010:0114Executive Summary
| Summary | |
|---|---|
| Title | acroread security and bug fix update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2010:0114 | First vendor Publication | 2010-02-18 |
| Vendor | RedHat | Last vendor Modification | 2010-02-18 |
| Severity (Vendor) | Critical | Revision | 01 |
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentification | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
Problem Description: Updated acroread packages that fix two security issues and a bug are now available for Red Hat Enterprise Linux 4 Extras and Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: RHEL Desktop Supplementary (v. 5 client) - i386, x86_64 RHEL Supplementary (v. 5 server) - i386, x86_64 Red Hat Desktop version 4 Extras - i386, x86_64 Red Hat Enterprise Linux AS version 4 Extras - i386, x86_64 Red Hat Enterprise Linux ES version 4 Extras - i386, x86_64 Red Hat Enterprise Linux WS version 4 Extras - i386, x86_64 3. Description: Adobe Reader allows users to view and print documents in Portable Document Format (PDF). This update fixes two vulnerabilities in Adobe Reader. These vulnerabilities are summarized on the Adobe Security Advisory APSB10-07 page listed in the References section. A specially-crafted PDF file could cause Adobe Reader to crash or, potentially, execute arbitrary code as the user running Adobe Reader when opened. (CVE-2010-0186, CVE-2010-0188) This update also fixes a bug where, on some systems, attempting to install or upgrade the acroread packages failed due to a package dependency issue. (BZ#557506) All Adobe Reader users should install these updated packages. They contain Adobe Reader version 9.3.1, which is not vulnerable to these issues and fixes this bug. All running instances of Adobe Reader must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 557506 - acroread requires openldap-devel which is in Workstation/ 563819 - CVE-2010-0186 flash-plugin: unauthorized cross-domain requests (APSB10-06) 566087 - CVE-2010-0188 acroread: unspecified code execution flaw |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2010-0114.html |
CWE : Common Weakness Enumeration
| id | Name |
|---|---|
| CWE-94 | Failure to Control Generation of Code ('Code Injection') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:8518 | |||
| Oval ID: | oval:org.mitre.oval:def:8518 | ||
| Title: | Adobe Flash Player, Acrobat, Adobe Reader and AIR Cross Domain Request Vulnerability | ||
| Description: | Cross-domain vulnerability in Adobe Flash Player before 10.0.45.2, Adobe AIR before 1.5.3.9130, and Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows remote attackers to bypass intended sandbox restrictions and make cross-domain requests via unspecified vectors. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-0186 |
Version: | 14 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows 7 |
Product(s): | Adobe Flash Player Adobe AIR Adobe Reader Adobe Acrobat |
| Definition Synopsis: | |||
|
|||
| Definition Id: oval:org.mitre.oval:def:8697 | |||
| Oval ID: | oval:org.mitre.oval:def:8697 | ||
| Title: | Adobe Reader and Acrobat Null Pointer Dereference Denial of Service Vulnerability | ||
| Description: | Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2010-0188 |
Version: | 11 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows 7 |
Product(s): | Adobe Reader Adobe Acrobat |
| Definition Synopsis: | |||
|
|||
CPE : Common Platform Enumeration
SAINT Exploits
| Description | Link |
|---|---|
| Adobe Reader Libtiff TIFFFetchShortPair Stack Buffer Overflow | More info here |
Open Source Vulnerability Database (OSVDB)
| id | Description |
|---|---|
| 62526 | Adobe Reader / Acrobat LibTiff Overflow |
| 62300 | Adobe Flash Player Cross-domain Sandbox Restriction Bypass |
Metasploit Database
| id | Description |
|---|---|
| 2010-02-16 | Adobe Acrobat Bundled LibTIFF Integer Overflow |
(Critical)
(Medium)
