PT-2008-3559 · Adobe · Acrobat Professional

Published 2008-05-08 · Updated 2018-10-30 · CVE-2008-2042

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Acrobat Professional versions 7.0.9 through 8.1.1

Description The issue concerns the Javascript API in Adobe Acrobat Professional, which exposes a dangerous method. This allows remote attackers to execute arbitrary commands or trigger a buffer overflow via a crafted PDF file. The exploitation involves invoking the app.checkForUpdate function with a malicious callback function.

Recommendations For Adobe Acrobat Professional version 7.0.9, update to a version that fixes this issue. For Adobe Acrobat Professional version 8.1.1, update to a version that fixes this issue. As a temporary workaround, consider disabling the app.checkForUpdate function until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-2042

Affected Products

Acrobat Professional

References · 9

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-239286-1 · Vendor Advisory
• http://secunia.com/advisories/30840 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2042 · Security Note
• http://adobe.com/support/security/bulletins/apsb08-13.html · Vendor Advisory
• http://vupen.com/english/advisories/2008/1966/references · Note
• http://securityreason.com/securityalert/3861 · Note
• http://securitytracker.com/id?1019971 · Note
• http://securityfocus.com/archive/1/491735/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42237 · Note