Where You Are

Adobe Reader/Acrobat Multiple Vulnerabilities

Report ID:	SA200900865
Source:	Secunia
Date of Discovery:	20.02.2009
Criticality:	Critical
Affects:	Adobe Acrobat 7 Professional Adobe Acrobat 7.x Adobe Acrobat 8 Professional Adobe Acrobat 8.x Adobe Acrobat 9.x Adobe Reader 7.x Adobe Reader 8.x Adobe Reader 9.x
Compromise From:	From remote
Compromise Type:	System access

Summary

Some vulnerabilities have been reported in Adobe Reader/Acrobat, which can be exploited by malicious people to compromise a user's system.

Detailed Description

Some vulnerabilities have been reported in Adobe Reader/Acrobat, which can be exploited by malicious people to compromise a user's system.

1) An array indexing error in the processing of JBIG2 streams can be exploited to corrupt arbitrary memory via a specially crafted PDF file.

Successful exploitation allows execution of arbitrary code.

NOTE: This vulnerability is currently being actively exploited.

2) An error when processing JavaScript calls to the "getIcon()" method of a "Collab" object can be exploited to cause a stack-based buffer overflow via a specially crafted argument.

NOTE: This is already fixed in Adobe Acrobat/Reader 8.1.3.

3) A boundary error in the processing of JBIG2 streams can be exploited to cause a heap-based buffer overflow via a specially crafted PDF file containing a malformed JBIG2 symbol dictionary segment.

4) A boundary error in the processing of JBIG2 streams can be exploited to cause a heap-based buffer overflow via a specially crafted PDF file.

5) A boundary error in the processing of JBIG2 streams while initialising memory can be exploited to trigger a memory corruption via a specially crafted PDF file.

6) An unspecified input validation error in the processing of JBIG2 streams can be exploited to potentially execute arbitrary code.

Solution

Tools

Choose Location:

Navigation

Subnavigation

Labs

Adobe Reader/Acrobat Multiple Vulnerabilities

Summary

Detailed Description

Solution

Original Reference