Executive Summary
Summary | |
---|---|
Title | Adobe Reader and Acrobat Vulnerabilities |
Informations | |||
---|---|---|---|
Name | TA10-231A | First vendor Publication | 2010-08-19 |
Vendor | US-CERT | Last vendor Modification | 2010-08-19 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Adobe has released Security Bulletin APSB10-17, which describes multiple vulnerabilities affecting Adobe Reader and Acrobat. I. Description Adobe Security Bulletin APSB10-17 describes a number of vulnerabilities affecting Adobe Reader and Acrobat. These vulnerabilities affect Reader and Acrobat 9.3.3, earlier 9.x versions, 8.2.3, and earlier 8.x versions. An attacker could exploit these vulnerabilities by convincing a user to open a specially crafted PDF file. The Adobe Reader browser plug-in, which can automatically open PDF documents hosted on a website, is available for multiple web browsers and operating systems. II. Impact These vulnerabilities could allow a remote attacker to execute arbitrary code, write arbitrary files or folders to the file system, escalate local privileges, or cause a denial of service on an affected system as the result of a user opening a malicious PDF file. III. Solution Update Adobe has released updates to address this issue. Users are encouraged to read Adobe Security Bulletin APSB10-17 and update vulnerable versions of Adobe Reader and Acrobat. Disable JavaScript in Adobe Reader and Acrobat Disabling JavaScript may prevent some exploits from resulting in code execution. Acrobat JavaScript can be disabled using the Preferences menu (Edit -> Preferences -> JavaScript; uncheck Enable Acrobat JavaScript). Adobe provides a framework to blacklist specific JavaScipt APIs. If JavaScript must be enabled, this feature may be useful when specific APIs are known to be vulnerable or used in attacks. Prevent Internet Explorer from automatically opening PDF files The installer for Adobe Reader and Acrobat configures Internet Explorer to automatically open PDF files without any user interaction. This behavior can be reverted to a safer option that prompts the user by importing the following as a .REG file: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\AcroExch.Document.7] Disable the display of PDF files in the web browser Preventing PDF files from opening inside a web browser will partially mitigate this vulnerability. If this workaround is applied, it may also mitigate future vulnerabilities. To prevent PDF files from automatically being opened in a web browser, do the following: 1. Open Adobe Acrobat Reader. Do not access PDF files from untrusted sources Do not open unfamiliar or unexpected PDF files, particularly those hosted on websites or delivered as email attachments. Please see Cyber Security Tip ST04-010. |
Original Source
Url : http://www.us-cert.gov/cas/techalerts/TA10-231A.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
50 % | CWE-264 | Permissions, Privileges, and Access Controls |
50 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:11693 | |||
Oval ID: | oval:org.mitre.oval:def:11693 | ||
Title: | Integer overflow in CoolType.dll in Adobe Reader 8.2.3 and 9.3.3, and Acrobat 9.3.3 | ||
Description: | Integer overflow in CoolType.dll in Adobe Reader 8.2.3 and 9.3.3, and Acrobat 9.3.3, allows remote attackers to execute arbitrary code via a TrueType font with a large maxCompositePoints value in a Maximum Profile (maxp) table. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2010-2862 | Version: | 19 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Adobe Reader Adobe Acrobat |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:22354 | |||
Oval ID: | oval:org.mitre.oval:def:22354 | ||
Title: | RHSA-2010:0636: acroread security update (Critical) | ||
Description: | Integer overflow in CoolType.dll in Adobe Reader 8.2.3 and 9.3.3, and Acrobat 9.3.3, allows remote attackers to execute arbitrary code via a TrueType font with a large maxCompositePoints value in a Maximum Profile (maxp) table. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2010:0636-02 CVE-2010-0209 CVE-2010-2213 CVE-2010-2214 CVE-2010-2215 CVE-2010-2216 CVE-2010-2862 | Version: | 81 |
Platform(s): | Red Hat Enterprise Linux 5 | Product(s): | acroread |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:22927 | |||
Oval ID: | oval:org.mitre.oval:def:22927 | ||
Title: | ELSA-2010:0636: acroread security update (Critical) | ||
Description: | Integer overflow in CoolType.dll in Adobe Reader 8.2.3 and 9.3.3, and Acrobat 9.3.3, allows remote attackers to execute arbitrary code via a TrueType font with a large maxCompositePoints value in a Maximum Profile (maxp) table. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2010:0636-02 CVE-2010-0209 CVE-2010-2213 CVE-2010-2214 CVE-2010-2215 CVE-2010-2216 CVE-2010-2862 | Version: | 29 |
Platform(s): | Oracle Linux 5 | Product(s): | acroread |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:7466 | |||
Oval ID: | oval:org.mitre.oval:def:7466 | ||
Title: | Adobe Reader 9.3.1 on Windows does not restrict the contents of one text field in the Launch File warning dialog | ||
Description: | Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in the Launch File warning dialog, which makes it easier for remote attackers to trick users into executing an arbitrary local program that was specified in a PDF document, as demonstrated by a text field that claims that the Open button will enable the user to read an encrypted message. | ||
Family: | windows | Class: | vulnerability |
Reference(s): | CVE-2010-1240 | Version: | 20 |
Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows 7 | Product(s): | Adobe Reader |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 1 | |
Application | 3 |
OpenVAS Exploits
Date | Description |
---|---|
2010-09-10 | Name : SuSE Update for acroread SUSE-SA:2010:037 File : nvt/gb_suse_2010_037.nasl |
2010-08-06 | Name : Adobe Reader/Acrobat Font Parsing Integer Overflow Vulnerability (Win) File : nvt/gb_adobe_prdts_int_overflow_vuln_win.nasl |
2010-08-06 | Name : Adobe Reader Font Parsing Integer Overflow Vulnerability (Linux) File : nvt/gb_adobe_reader_int_overflow_vuln_lin.nasl |
2010-07-12 | Name : SuSE Update for acroread SUSE-SA:2010:029 File : nvt/gb_suse_2010_029.nasl |
2010-04-07 | Name : Adobe Reader PDF Handling Multiple Vulnerabilities (Win) File : nvt/gb_adobe_reader_pdf_doc_mult_vuln_win.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
66859 | Adobe Reader / Acrobat CoolType.dll maxp Table maxComponentPoints Field Font ... |
63667 | Adobe Reader Crafted PDF File Open Launch Sequence Arbitrary Program Execution |
Snort® IPS/IDS
Date | Description |
---|---|
2016-03-14 | Adobe Acrobat font parsing integer overflow attempt RuleID : 36886 - Revision : 2 - Type : FILE-PDF |
2016-03-14 | Adobe Acrobat font parsing integer overflow attempt RuleID : 36885 - Revision : 2 - Type : FILE-PDF |
2014-01-10 | Adobe Acrobat font parsing integer overflow attempt RuleID : 28624 - Revision : 5 - Type : FILE-PDF |
2014-01-10 | Adobe Acrobat font parsing integer overflow attempt RuleID : 28623 - Revision : 5 - Type : FILE-PDF |
2014-01-10 | Adobe Acrobat font parsing integer overflow attempt RuleID : 28462 - Revision : 9 - Type : FILE-PDF |
2014-01-10 | Adobe Acrobat font parsing integer overflow attempt RuleID : 28461 - Revision : 9 - Type : FILE-PDF |
2014-01-10 | PDF with click-to-launch executable RuleID : 26662 - Revision : 4 - Type : FILE-PDF |
2014-01-10 | PDF with click-to-launch executable RuleID : 26661 - Revision : 5 - Type : FILE-PDF |
2014-01-10 | Adobe Acrobat font parsing integer overflow attempt RuleID : 24508 - Revision : 14 - Type : FILE-PDF |
2014-01-10 | Adobe Acrobat font parsing integer overflow attempt RuleID : 24507 - Revision : 14 - Type : FILE-PDF |
2014-01-10 | Microsoft Windows kernel-mode drivers core font parsing integer overflow attempt RuleID : 24487 - Revision : 9 - Type : FILE-PDF |
2014-01-10 | Microsoft Windows kernel-mode drivers core font parsing integer overflow attempt RuleID : 24486 - Revision : 8 - Type : FILE-PDF |
2014-01-10 | Microsoft Windows kernel-mode drivers core font parsing integer overflow attempt RuleID : 24485 - Revision : 8 - Type : FILE-PDF |
2014-01-10 | PDF with click-to-launch executable RuleID : 23516 - Revision : 7 - Type : FILE-PDF |
2014-01-10 | PDF with click-to-launch executable RuleID : 23515 - Revision : 6 - Type : FILE-PDF |
2014-01-10 | PDF with click-to-launch executable RuleID : 23514 - Revision : 6 - Type : FILE-PDF |
2014-01-10 | PDF with click-to-launch executable RuleID : 23513 - Revision : 6 - Type : FILE-PDF |
2014-01-10 | Microsoft Windows kernel-mode drivers core font parsing integer overflow attempt RuleID : 23508 - Revision : 5 - Type : FILE-PDF |
2014-01-10 | Adobe Acrobat font parsing integer overflow attempt RuleID : 23507 - Revision : 6 - Type : FILE-PDF |
2014-01-10 | Phoenix exploit kit post-compromise behavior RuleID : 21860 - Revision : 5 - Type : MALWARE-CNC |
2014-01-10 | Phoenix exploit kit landing page RuleID : 21640 - Revision : 6 - Type : EXPLOIT-KIT |
2014-01-10 | PDF with click-to-launch executable RuleID : 19648 - Revision : 13 - Type : FILE-PDF |
2014-01-10 | PDF with click-to-launch executable RuleID : 19647 - Revision : 13 - Type : FILE-PDF |
2014-01-10 | PDF with click-to-launch executable RuleID : 19646 - Revision : 13 - Type : FILE-PDF |
2014-01-10 | Adobe Acrobat font parsing integer overflow attempt RuleID : 17288 - Revision : 9 - Type : FILE-PDF |
2014-01-10 | PDF with click-to-launch executable RuleID : 16523 - Revision : 12 - Type : FILE-PDF |
2014-01-10 | Microsoft Windows kernel-mode drivers core font parsing integer overflow attempt RuleID : 16231 - Revision : 22 - Type : FILE-PDF |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_acroread-100826.nasl - Type : ACT_GATHER_INFO |
2011-01-27 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_acroread_ja-7132.nasl - Type : ACT_GATHER_INFO |
2011-01-27 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_acroread_ja-7086.nasl - Type : ACT_GATHER_INFO |
2011-01-27 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_acroread-7131.nasl - Type : ACT_GATHER_INFO |
2011-01-27 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_acroread-7087.nasl - Type : ACT_GATHER_INFO |
2010-12-02 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_acroread_ja-100825.nasl - Type : ACT_GATHER_INFO |
2010-12-02 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_acroread_ja-100702.nasl - Type : ACT_GATHER_INFO |
2010-12-02 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_acroread-100825.nasl - Type : ACT_GATHER_INFO |
2010-12-02 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_acroread-100702.nasl - Type : ACT_GATHER_INFO |
2010-09-02 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_acroread-100826.nasl - Type : ACT_GATHER_INFO |
2010-09-02 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_acroread-100826.nasl - Type : ACT_GATHER_INFO |
2010-08-23 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0636.nasl - Type : ACT_GATHER_INFO |
2010-08-19 | Name : The version of Adobe Reader on the remote Windows host is affected by multipl... File : adobe_reader_apsb10-17.nasl - Type : ACT_GATHER_INFO |
2010-08-19 | Name : The version of Adobe Acrobat on the remote Windows host is affected by multip... File : adobe_acrobat_apsb10-17.nasl - Type : ACT_GATHER_INFO |
2010-07-28 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0503.nasl - Type : ACT_GATHER_INFO |
2010-07-09 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_acroread-100706.nasl - Type : ACT_GATHER_INFO |
2010-07-09 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_acroread-100708.nasl - Type : ACT_GATHER_INFO |
2010-07-09 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_acroread-100708.nasl - Type : ACT_GATHER_INFO |
2010-06-30 | Name : The version of Adobe Acrobat on the remote Windows host is affected by multip... File : adobe_acrobat_apsb10-15.nasl - Type : ACT_GATHER_INFO |
2010-06-30 | Name : The version of Adobe Reader on the remote Windows host is affected by multipl... File : adobe_reader_apsb10-15.nasl - Type : ACT_GATHER_INFO |