PT-2009-5782 · Adobe · Photoshop Elements

Published 2009-09-30 · Updated 2024-02-08 · CVE-2009-3489

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Photoshop Elements version 8.0

Description The issue allows local users to stop the service, execute arbitrary commands as SYSTEM by modifying the binPath variable using the config command, or restart the service. This is due to an insecure security descriptor in the Adobe Active File Monitor V8 service installed by Adobe Photoshop Elements.

Recommendations For Adobe Photoshop Elements version 8.0, consider restricting access to the service to prevent unauthorized modifications, and avoid using the config command to modify the binPath variable until a fix is available. As a temporary workaround, consider disabling the Adobe Active File Monitor V8 service until a patch is available.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2009-3489

Affected Products

Photoshop Elements

References · 11

• 🔥 http://securityfocus.com/bid/36542 · Exploit
• 🔥 https://exploit-db.com/exploits/9807 · Exploit
• 🔥 http://retrogod.altervista.org/9sg_adobe_pe_local.html · Exploit
• 🔥 https://exploit-db.com/exploits/9988 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3489 · Security Note
• http://secunia.com/advisories/36895 · Note
• https://t.me/cvenotify/70602 · Telegram Post
• http://securityfocus.com/archive/1/506806/100/0/threaded · Note
• http://blogs.adobe.com/psirt/2009/09/potential_photoshop_elements_8.html · Note
• http://securitytracker.com/id?1022963 · Note
• http://vupen.com/english/advisories/2009/2798 · Note