PT-2008-3559 · Adobe · Acrobat Professional

Publicado 2008-05-08 · Atualizado 2018-10-30 · CVE-2008-2042

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Acrobat Professional versions 7.0.9 through 8.1.1

Description The issue concerns the Javascript API in Adobe Acrobat Professional, which exposes a dangerous method. This allows remote attackers to execute arbitrary commands or trigger a buffer overflow via a crafted PDF file. The exploitation involves invoking the app.checkForUpdate function with a malicious callback function.

Recommendations For Adobe Acrobat Professional version 7.0.9, update to a version that fixes this issue. For Adobe Acrobat Professional version 8.1.1, update to a version that fixes this issue. As a temporary workaround, consider disabling the app.checkForUpdate function until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-2042

Produtos afetados

Acrobat Professional

Referências · 9

• http://vupen.com/english/advisories/2008/1966/references · Nota
• http://securityreason.com/securityalert/3861 · Nota
• http://securitytracker.com/id?1019971 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-239286-1 · Aviso do Fabricante
• http://securityfocus.com/archive/1/491735/100/0/threaded · Nota
• http://secunia.com/advisories/30840 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-2042 · Nota de Segurança
• http://adobe.com/support/security/bulletins/apsb08-13.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42237 · Nota