Executive Summary

Informations
Name CVE-2009-0658 First vendor Publication 2009-02-20
Vendor Cve Last vendor Modification 2019-09-27

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Overall CVSS Score 7.8
Base Score 7.8 Environmental Score 7.8
impact SubScore 5.9 Temporal Score 7.8
Exploitabality Sub Score 1.8
 
Attack Vector Local Attack Complexity Low
Privileges Required None User Interaction Required
Scope Unchanged Confidentiality Impact High
Integrity Impact High Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as exploited in the wild in February 2009 by Trojan.Pidief.E.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0658

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:5697
 
Oval ID: oval:org.mitre.oval:def:5697
Title: Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier (APSA09-01)
Description: Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as exploited in the wild in February 2009 by Trojan.Pidief.E.
Family: windows Class: vulnerability
Reference(s): CVE-2009-0658
Version: 9
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows Server 2008
Product(s): Adobe Acrobat
Adobe Reader
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 104
Application 66

SAINT Exploits

Description Link
Adobe Reader JBIG2 image stream buffer overflow More info here

OpenVAS Exploits

Date Description
2009-04-28 Name : SuSE Security Summary SUSE-SR:2009:009
File : nvt/suse_sr_2009_009.nasl
2009-04-20 Name : Gentoo Security Advisory GLSA 200904-17 (acroread)
File : nvt/glsa_200904_17.nasl
2009-03-31 Name : RedHat Security Advisory RHSA-2009:0376
File : nvt/RHSA_2009_0376.nasl
2009-03-31 Name : SuSE Security Advisory SUSE-SA:2009:014 (acroread)
File : nvt/suse_sa_2009_014.nasl
2009-03-03 Name : Buffer Overflow Vulnerability in Adobe Reader (Linux)
File : nvt/secpod_adobe_prdts_bof_vuln_lin.nasl
2009-03-03 Name : Buffer Overflow Vulnerability in Adobe Acrobat and Reader (Win)
File : nvt/secpod_adobe_prdts_bof_vuln_win.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
52073 Adobe Reader / Acrobat Document Handling JBIG2 Compression Overflow

A buffer overflow exists in Acrobat and Acrobat Reader. They fail to validate PDF files which use JBIG2 compression routines resulting in a buffer overflow. With a specially crafted file, a context-dependent attacker can cause arbitrary code execution resulting in a loss of integrity.

Snort® IPS/IDS

Date Description
2015-01-15 Adobe Acrobat Reader PDF JBIG2 remote code execution attempt
RuleID : 32786 - Revision : 2 - Type : FILE-PDF
2014-01-10 Adobe Acrobat Reader PDF JBIG2 remote code execution attempt
RuleID : 24124 - Revision : 5 - Type : FILE-PDF
2014-01-10 Adobe Acrobat Reader PDF JBIG2 remote code execution attempt
RuleID : 20575 - Revision : 13 - Type : FILE-PDF
2014-01-10 Suspicious JBIG2 pdf file sent with email
RuleID : 15497 - Revision : 7 - Type : FILE-PDF
2014-01-10 Suspicious JBIG2 pdf file sent through email
RuleID : 15496 - Revision : 7 - Type : FILE-PDF
2014-01-10 Suspicious JBIG2 pdf file sent by email
RuleID : 15495 - Revision : 7 - Type : FILE-PDF
2014-01-10 Suspicious JBIG2 pdf file sent from email
RuleID : 15494 - Revision : 7 - Type : FILE-PDF
2014-01-10 Suspicious JBIG2 pdf file sent in email
RuleID : 15360 - Revision : 8 - Type : FILE-PDF
2014-01-10 Suspicious JBIG2 pdf file sent via email
RuleID : 15359 - Revision : 8 - Type : FILE-PDF
2014-01-10 Adobe Acrobat Reader JBIG2 remote code execution attempt
RuleID : 15358 - Revision : 11 - Type : FILE-PDF
2014-01-10 Adobe Acrobat Reader JBIG2 remote code execution attempt
RuleID : 15357 - Revision : 14 - Type : FILE-PDF
2014-01-10 Adobe PDF JBIG2 remote code execution attempt
RuleID : 15356 - Revision : 4 - Type : SMTP
2014-01-10 Adobe PDF JBIG2 remote code execution attempt
RuleID : 15355 - Revision : 4 - Type : WEB-CLIENT
2014-01-10 Adobe PDF JBIG2 remote code execution attempt
RuleID : 15354 - Revision : 4 - Type : SMTP

Nessus® Vulnerability Scanner

Date Description
2011-01-27 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_acroread-6121.nasl - Type : ACT_GATHER_INFO
2011-01-27 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_acroread_ja-6161.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 11 host is missing a security update.
File : suse_11_acroread-090325.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 11 host is missing a security update.
File : suse_11_acroread_ja-090415.nasl - Type : ACT_GATHER_INFO
2009-08-28 Name : The version of Adobe Acrobat on the remote Windows host is affected by multip...
File : adobe_acrobat_91.nasl - Type : ACT_GATHER_INFO
2009-08-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2009-0376.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_0_acroread-090325.nasl - Type : ACT_GATHER_INFO
2009-07-21 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_acroread-090325.nasl - Type : ACT_GATHER_INFO
2009-04-21 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200904-17.nasl - Type : ACT_GATHER_INFO
2009-03-27 Name : The remote openSUSE host is missing a security update.
File : suse_acroread-6120.nasl - Type : ACT_GATHER_INFO
2009-03-11 Name : The PDF file viewer on the remote Windows host is affected by multiple vulner...
File : adobe_reader_91.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/33751
CERT http://www.us-cert.gov/cas/techalerts/TA09-051A.html
CERT-VN http://www.kb.cert.org/vuls/id/905281
CONFIRM http://www.adobe.com/support/security/advisories/apsa09-01.html
http://www.adobe.com/support/security/bulletins/apsb09-04.html
EXPLOIT-DB https://www.exploit-db.com/exploits/8090
https://www.exploit-db.com/exploits/8099
FRSIRT http://www.vupen.com/english/advisories/2009/0472
GENTOO http://security.gentoo.org/glsa/glsa-200904-17.xml
MISC http://isc.sans.org/diary.html?n&storyid=5902
http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20090219
http://www.symantec.com/security_response/writeup.jsp?docid=2009-021212-5523-...
OSVDB http://osvdb.org/52073
OVAL https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
REDHAT http://www.redhat.com/support/errata/RHSA-2009-0376.html
SECTRACK http://www.securitytracker.com/id?1021739
SECUNIA http://secunia.com/advisories/33901
http://secunia.com/advisories/34392
http://secunia.com/advisories/34490
http://secunia.com/advisories/34706
http://secunia.com/advisories/34790
SUNALERT http://sunsolve.sun.com/search/document.do?assetkey=1-66-256788-1
SUSE http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html
VUPEN http://www.vupen.com/english/advisories/2009/1019
XF https://exchange.xforce.ibmcloud.com/vulnerabilities/48825

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
Date Informations
2022-10-19 01:08:13
  • Multiple Updates
2021-05-04 12:10:05
  • Multiple Updates
2021-04-22 01:10:28
  • Multiple Updates
2020-05-23 13:16:52
  • Multiple Updates
2020-05-23 01:40:04
  • Multiple Updates
2020-05-23 00:23:23
  • Multiple Updates
2019-09-27 21:19:47
  • Multiple Updates
2018-10-31 00:19:55
  • Multiple Updates
2017-09-29 09:24:05
  • Multiple Updates
2017-08-17 09:22:28
  • Multiple Updates
2016-06-28 17:36:01
  • Multiple Updates
2016-04-27 09:34:59
  • Multiple Updates
2016-04-26 18:39:16
  • Multiple Updates
2015-01-15 21:23:46
  • Multiple Updates
2014-02-17 10:48:56
  • Multiple Updates
2014-01-19 21:25:43
  • Multiple Updates
2013-05-10 23:44:52
  • Multiple Updates