PT-2014-8850 · Adobe · Reader+1

Publicado 2014-11-30 · Atualizado 2014-12-17 · CVE-2014-9150

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Adobe Reader and Acrobat versions 11.0.0 through 11.0.8

Description A race condition in the MoveFileEx call hook feature allows attackers to bypass a sandbox protection mechanism, enabling them to write to files in arbitrary locations via an NTFS junction attack.

Recommendations For Adobe Reader and Acrobat versions 11.0.0 through 11.0.8, update to version 11.0.09 or later to resolve the issue.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2014-9150

Produtos afetados

Acrobat

Reader

Referências · 3

• https://code.google.com/p/google-security-research/issues/detail?id=103 · Nota
• http://helpx.adobe.com/security/products/reader/apsb14-28.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-9150 · Nota de Segurança