Executive Summary
Summary | |
---|---|
Title | Adobe Reader and Acrobat JavaScript Vulnerabilities |
Informations | |||
---|---|---|---|
Name | TA09-133B | First vendor Publication | 2009-05-13 |
Vendor | US-CERT | Last vendor Modification | 2009-05-13 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Adobe has released Security Bulletin APSB09-06, which describes Adobe Reader and Acrobat updates for two JavaScript vulnerabilities that could allow a remote attacker to execute arbitrary code. I. Description Adobe Security Bulletin APSB09-06 announces updates for two JavaScript vulnerabilities that affect Adobe Reader and Acrobat. * A vulnerability in the getAnnots() method (CVE-2009-1492) * A vulnerability in the customDictionaryOpen() method Further details are available in Vulnerability Note VU#970180. An attacker could exploit these vulnerabilities by convincing a user to open a specially crafted Adobe Portable Document Format II. Impact By convincing a victim to open a specially crafted PDF file, a remote, unauthenticated attacker may be able to execute arbitrary code. III. Solution Update Adobe has released updates to address this issue. Users are encouraged to read Adobe Security Bulletin APSB09-06 and update vulnerable versions of Adobe Reader and Acrobat. According to APSB09-06, these vulnerabilities are addressed in versions 9.1.1, Disable JavaScript in Adobe Reader and Acrobat Disabling JavaScript prevents these vulnerabilities from being exploited and reduces attack surface. If this workaround is applied to updated versions of the Adobe Reader and Acrobat, it may protect against future vulnerabilities. To disable JavaScript in Adobe Reader: 1. Open Adobe Acrobat Reader. Disabling JavaScript will not resolve the vulnerabilities, it will only disable the vulnerable JavaScript component. When JavaScript is disabled, Adobe Reader and Acrobat prompt to re-enable JavaScript when opening a PDF that contains JavaScript. Prevent Internet Explorer from automatically opening PDF documents The installer for Adobe Reader and Acrobat configures Internet Explorer to automatically open PDF files without any user interaction. This behavior can be reverted to the safer option of prompting the user by importing the following as a .REG file: Windows Registry Editor Version 5.00 Disable the display of PDF documents in the web browser Preventing PDF documents from opening inside a web browser reduces attack surface. If this workaround is applied to updated versions of the Adobe Reader and Acrobat, it may protect against future vulnerabilities. To prevent PDF documents from automatically being opened in a web browser with Adobe Reader: 1. Open Adobe Acrobat Reader. Rename or remove Annots.api To disable the vulnerable getAnnots() method, rename or remove the Annots.api file. This will disable some Annotation functionality, however annotations can still be viewed. This does not protect against the customDictionaryOpen() vulnerability. On Windows, Annots.api is typically located here: "%ProgramFiles%\Adobe\Reader 9.0\Reader\plug_ins" Example location on GNU/Linux: /opt/Adobe/Reader8/Reader/intellinux/plug_ins/Annots.api Do not access PDF documents from untrusted sources Do not open unfamiliar or unexpected PDF documents, particularly those hosted on web sites or delivered as email attachments. Please see Cyber Security Tip ST04-010. |
Original Source
Url : http://www.us-cert.gov/cas/techalerts/TA09-133B.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-399 | Resource Management Errors |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:22282 | |||
Oval ID: | oval:org.mitre.oval:def:22282 | ||
Title: | ELSA-2009:0478: acroread security update (Critical) | ||
Description: | The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and UNIX allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that triggers a call to this method with a long string in the second argument. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2009:0478-01 CVE-2009-1492 CVE-2009-1493 | Version: | 13 |
Platform(s): | Oracle Linux 5 | Product(s): | acroread |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
SAINT Exploits
Description | Link |
---|---|
Adobe Reader Javascript API getAnnots method vulnerability | More info here |
Adobe Reader Javascript API spell.customDictonaryOpen memory corruption | More info here |
OpenVAS Exploits
Date | Description |
---|---|
2010-04-07 | Name : Adobe Reader PDF Handling Code Execution Vulnerability (Win) File : nvt/gb_adobe_reader_exe_code_exec_vuln_win.nasl |
2009-10-13 | Name : Solaris Update for Adobe Acrobat Reader 121104-10 File : nvt/gb_solaris_121104_10.nasl |
2009-07-29 | Name : Gentoo Security Advisory GLSA 200907-06 (acroread) File : nvt/glsa_200907_06.nasl |
2009-06-15 | Name : SuSE Security Summary SUSE-SR:2009:011 File : nvt/suse_sr_2009_011.nasl |
2009-05-25 | Name : SuSE Security Advisory SUSE-SA:2009:027 (acroread) File : nvt/suse_sa_2009_027.nasl |
2009-05-20 | Name : RedHat Security Advisory RHSA-2009:0478 File : nvt/RHSA_2009_0478.nasl |
2009-05-11 | Name : Adobe Reader Denial of Service Vulnerability (May09) File : nvt/gb_adobe_reader_dos_vuln_may09_lin.nasl |
2009-05-11 | Name : Adobe Reader/Acrobat Denial of Service Vulnerability (May09) File : nvt/gb_adobe_reader_dos_vuln_may09_win.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
54130 | Adobe Reader getAnnots() JavaScript Method PDF Handling Memory Corruption A memory corruption flaw exists in Adobe and Acrobat Reader. The getAnnots() JavaScript method fails to validate input read from a malformed PDF file resulting in memory corruption. With a specially crafted file, a context-dependent attacker can cause arbitrary code execution resulting in a loss of integrity. |
54129 | Adobe Reader customDictionaryOpen() JavaScript Method PDF Handling Memory Cor... |
Snort® IPS/IDS
Date | Description |
---|---|
2018-02-06 | Adobe Acrobat Reader getAnnots exploit attempt RuleID : 45369 - Revision : 1 - Type : FILE-PDF |
2016-07-01 | Adobe Acrobat Reader getAnnots exploit attempt RuleID : 39109 - Revision : 2 - Type : FILE-PDF |
2016-07-01 | Adobe Acrobat Reader getAnnots exploit attempt RuleID : 39108 - Revision : 2 - Type : FILE-PDF |
2014-01-10 | Adobe Acrobat Reader getAnnots exploit attempt RuleID : 23504 - Revision : 8 - Type : FILE-PDF |
2014-01-10 | Adobe Acrobat Reader spell.customDictionaryOpen exploit attempt RuleID : 23500 - Revision : 5 - Type : FILE-PDF |
2014-01-10 | Adobe Acrobat Reader getAnnots exploit attempt RuleID : 15493 - Revision : 15 - Type : FILE-PDF |
2014-01-10 | Adobe Acrobat Reader spell.customDictionaryOpen exploit attempt RuleID : 15492 - Revision : 15 - Type : FILE-PDF |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2011-01-27 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_acroread-6260.nasl - Type : ACT_GATHER_INFO |
2011-01-27 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_acroread_ja-6264.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_acroread-090519.nasl - Type : ACT_GATHER_INFO |
2009-09-24 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_acroread_ja-090519.nasl - Type : ACT_GATHER_INFO |
2009-08-28 | Name : The version of Adobe Acrobat on the remote Windows host is affected by a memo... File : adobe_acrobat_911.nasl - Type : ACT_GATHER_INFO |
2009-08-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-0478.nasl - Type : ACT_GATHER_INFO |
2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_acroread-090519.nasl - Type : ACT_GATHER_INFO |
2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_acroread-090519.nasl - Type : ACT_GATHER_INFO |
2009-07-13 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200907-06.nasl - Type : ACT_GATHER_INFO |
2009-05-22 | Name : The remote openSUSE host is missing a security update. File : suse_acroread-6258.nasl - Type : ACT_GATHER_INFO |
2009-05-13 | Name : The PDF file viewer on the remote Windows host is affected by a memory corrup... File : adobe_reader_911.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2013-05-11 00:53:42 |
|