PT-2009-6359 · Adobe · Illustrator Cs3+1

Published 2009-12-04 · Updated 2018-10-10 · CVE-2009-4195

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Illustrator CS4 version 14.0.0 Adobe Illustrator CS3 versions 13.0.3 and earlier Adobe Illustrator CS3 version 13.0.0

Description The issue allows remote attackers to execute arbitrary code via a long DSC comment in an Encapsulated PostScript (.eps) file.

Recommendations For Adobe Illustrator CS4 version 14.0.0, update to a version that fixes the buffer overflow issue. For Adobe Illustrator CS3 versions 13.0.3 and earlier, update to a version that fixes the buffer overflow issue. For Adobe Illustrator CS3 version 13.0.0, update to a version that fixes the buffer overflow issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-4195

Affected Products

Illustrator Cs3

Illustrator Cs4

References · 15

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_illustrator_v14_eps.rb · Exploit
• 🔥 https://exploit-db.com/exploits/10344 · Exploit
• 🔥 https://exploit-db.com/exploits/10281 · Exploit
• 🔥 http://retrogod.altervista.org/9sg_adobe_illuso.html · Exploit
• 🔥 http://securityfocus.com/bid/37192 · Exploit
• 🔥 https://exploit-db.com/exploits/16669 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4195 · Security Note
• http://vupen.com/english/advisories/2009/3396 · Vendor Advisory
• http://secunia.com/advisories/37563 · Vendor Advisory
• http://adobe.com/support/security/bulletins/apsb10-01.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54521 · Note
• http://securitytracker.com/id?1023276 · Note
• http://securityfocus.com/archive/1/508175/100/0/threaded · Note
• http://osvdb.org/60632 · Note
• http://blogs.adobe.com/psirt/2009/12/potential_adobe_illustrator_cs.html · Note