PT-2014-8850 · Adobe · Reader+1

Published 2014-11-30 · Updated 2014-12-17 · CVE-2014-9150

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Adobe Reader and Acrobat versions 11.0.0 through 11.0.8

Description A race condition in the MoveFileEx call hook feature allows attackers to bypass a sandbox protection mechanism, enabling them to write to files in arbitrary locations via an NTFS junction attack.

Recommendations For Adobe Reader and Acrobat versions 11.0.0 through 11.0.8, update to version 11.0.09 or later to resolve the issue.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2014-9150

Affected Products

Acrobat

Reader

References · 3

• http://helpx.adobe.com/security/products/reader/apsb14-28.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9150 · Security Note
• https://code.google.com/p/google-security-research/issues/detail?id=103 · Note