PT-2010-1187 · Adobe · Reader+1

Didier Stevens

·

Publicado

2010-04-05

·

Atualizado

2017-09-19

·

CVE-2010-1240

CVSS v2.0

9.3

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Adobe Reader and Acrobat versions 9.x prior to 9.3.3 Adobe Reader and Acrobat versions 8.x prior to 8.2.3
Description The issue allows remote attackers to trick users into executing an arbitrary local program specified in a PDF document. This is due to the lack of restriction on the contents of a text field in the Launch File warning dialog, making it easier for attackers to deceive users. The vulnerability can be exploited by a specially crafted PDF file, potentially allowing a remote attacker to execute arbitrary code.
Recommendations For Adobe Reader and Acrobat versions 9.x prior to 9.3.3, update to version 9.3.3 or later. For Adobe Reader and Acrobat versions 8.x prior to 8.2.3, update to version 8.2.3 or later.

Exploit

Correção

OS Command Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264CWE-78

Identificadores relacionados

BDU:2023-01768
CVE-2010-1240
RHSA-2010:0503

Produtos afetados

Acrobat
Reader