PT-2009-6359 · Adobe · Illustrator Cs3+1

Publicado 2009-12-04 · Atualizado 2018-10-10 · CVE-2009-4195

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Illustrator CS4 version 14.0.0 Adobe Illustrator CS3 versions 13.0.3 and earlier Adobe Illustrator CS3 version 13.0.0

Description The issue allows remote attackers to execute arbitrary code via a long DSC comment in an Encapsulated PostScript (.eps) file.

Recommendations For Adobe Illustrator CS4 version 14.0.0, update to a version that fixes the buffer overflow issue. For Adobe Illustrator CS3 versions 13.0.3 and earlier, update to a version that fixes the buffer overflow issue. For Adobe Illustrator CS3 version 13.0.0, update to a version that fixes the buffer overflow issue.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-4195

Produtos afetados

Illustrator Cs3

Illustrator Cs4

Referências · 15

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_illustrator_v14_eps.rb · Exploit
• 🔥 https://exploit-db.com/exploits/10344 · Exploit
• 🔥 https://exploit-db.com/exploits/10281 · Exploit
• 🔥 http://retrogod.altervista.org/9sg_adobe_illuso.html · Exploit
• 🔥 http://securityfocus.com/bid/37192 · Exploit
• 🔥 https://exploit-db.com/exploits/16669 · Exploit
• http://adobe.com/support/security/bulletins/apsb10-01.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4195 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54521 · Nota
• http://securitytracker.com/id?1023276 · Nota
• http://vupen.com/english/advisories/2009/3396 · Aviso do Fabricante
• http://securityfocus.com/archive/1/508175/100/0/threaded · Nota
• http://secunia.com/advisories/37563 · Aviso do Fabricante
• http://osvdb.org/60632 · Nota
• http://blogs.adobe.com/psirt/2009/12/potential_adobe_illustrator_cs.html · Nota