Executive Summary
Summary | |
---|---|
Title | Adobe Reader EScript.api arbitrary code execution |
Informations | |||
---|---|---|---|
Name | VU#140129 | First vendor Publication | 2008-02-12 |
Vendor | VU-CERT | Last vendor Modification | 2008-02-12 |
Severity (Vendor) | N/A | Revision | M |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Vulnerability Note VU#140129Adobe Reader EScript.api arbitrary code executionOverviewThe Adobe Acrobat Reader contains a vulnerability that may allow an attacker to execute arbitrary code.I. DescriptionAdobe Acrobat Reader is software designed to view Portable Document Format (PDF) files. Adobe also distributes the Adobe Acrobat Plug-In to allow users to view PDF files inside of a web browser.Per iDefense Advisory 02.08.08: Remote exploitation of an insecure method exposed by the JavaScript library in Adobe Reader and Acrobat could allow an attacker to execute arbitrary code as the current user. Adobe Reader and Acrobat implement a version of JavaScript in the EScript.api plug-in which is based on the reference implementation used in Mozilla products. One of the methods exposed allows direct control over low level features of the object, which in turn allows execution of arbitrary code. II. ImpactBy convincing a user to open a malicious PDF file, a remote, unauthenticated attacker may be able to execute arbitrary code. This can happen in several ways, such as opening an email attachment or viewing a web page.III. SolutionUpdateAdobe has released Adobe Reader and Acrobat 8.1.2 to address this and other issues.
Prevent Internet Explorer from automatically opening PDF documents The installer for Adobe Reader and Acrobat configures Internet Explorer to automatically open PDF files without any user interaction. This behavior can be reverted to the safer option of prompting the user by importing the following as a .REG file: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOTAcroExch.Document.7] "EditFlags"=hex:00,00,00,00 Disable JavaScript in Adobe Reader and Acrobat Disabling Javascript may prevent this vulnerability from being exploited. Acrobat JavaScript can be disabled in the General preferences dialog (Edit -> Preferences -> JavaScript and un-check Enable Acrobat JavaScript). Do not open untrusted PDF files Do not open unfamiliar or unexpected PDF attachments. Users can convert PDF documents to text by using the Adobe Online Conversion Tools site. See the Online Conversion Tools FAQ for information about this service. This workaround will not mitigate all attack vectors. Systems Affected
References
Thanks to Adobe and iDefense for information that was used in this report. This document was written by Ryan Giobbi.
|
Original Source
Url : http://www.kb.cert.org/vuls/id/140129 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:9928 | |||
Oval ID: | oval:org.mitre.oval:def:9928 | ||
Title: | Adobe Reader and Acrobat 8.1.1 and earlier allows remote attackers to execute arbitrary code via a crafted PDF file that calls an insecure JavaScript method in the EScript.api plug-in. NOTE: this issue might be subsumed by CVE-2008-0655. | ||
Description: | Adobe Reader and Acrobat 8.1.1 and earlier allows remote attackers to execute arbitrary code via a crafted PDF file that calls an insecure JavaScript method in the EScript.api plug-in. NOTE: this issue might be subsumed by CVE-2008-0655. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2007-5663 | Version: | 3 |
Platform(s): | Red Hat Enterprise Linux Extras 3 Red Hat Enterprise Linux Extras 4 Red Hat Enterprise Linux Extras 5 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2008-09-24 | Name : Gentoo Security Advisory GLSA 200803-01 (acroread) File : nvt/glsa_200803_01.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
41494 | Adobe Reader / Acrobat EScript.api Plug-in Crafted PDF Arbitrary Code Execution |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2009-08-28 | Name : The version of Adobe Acrobat on the remote Windows host is affected by multip... File : adobe_acrobat_812.nasl - Type : ACT_GATHER_INFO |
2009-08-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0144.nasl - Type : ACT_GATHER_INFO |
2008-03-04 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200803-01.nasl - Type : ACT_GATHER_INFO |
2008-02-06 | Name : The PDF file viewer on the remote Windows host is affected by multiple vulner... File : adobe_reader_812.nasl - Type : ACT_GATHER_INFO |