Stack-based buffer overflow in Adobe Acrobat and Adobe Reader - CVE-2007-5659

Vulnerability identifier: #VU1330

CSH Severity: Critical

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2007-5659

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to a boundary error within Javascript method. A remote attacker can create a specially .pdf file, trick the victim into opening it, trigger stack-based buffer overflow and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Adobe Acrobat
Adobe Reader

Install update from vendor's website:

Adobe Reader 7 and 8:
https://www.adobe.com/products/acrobat/readstep2.html
Adobe Acrobat for Windows:
https://www.adobe.com/support/downloads/detail.jsp?ftpID=3849
Adobe Acrobat for Macintosh:
https://www.adobe.com/support/downloads/detail.jsp?ftpID=3856
Adobe Acrobat 3D version:
https://www.adobe.com/support/downloads/detail.jsp?ftpID=3850
Adobe Reader 7:
https://www.adobe.com/go/getreader
Adobe Acrobat 7 for Windows:
https://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows
Adobe Acrobat 7 for Macintosh:
https://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh

• Exploit #558 - Adobe - Collab.collectEmailInfo() Buffer Overflow (Metasploit) (March 18, 2020)
• Exploit #559 - Adobe Acrobat and Reader 8.1.1 - Multiple Arbitrary Code Execution / Security Vulnerabilities (March 18, 2020)
• Exploit #1652 - Adobe Collab.collectEmailInfo() Buffer Overflow (March 18, 2020)

• https://www.adobe.com/support/security/bulletins/apsb08-13.html

• Multiple vulnerabilities in Adobe Reader and Adobe Acrobat