#VU1393 Untrusted search path in Adobe Acrobat and Adobe Reader - CVE-2009-3954

Vulnerability identifier: #VU1393

Vulnerability risk: High

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2009-3954

CWE-ID: CWE-426

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Adobe Acrobat
Adobe Reader

Software vendor:
Adobe

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in 3D implementation. A remote attacker can place a .pdf file along with malicious DLL on a public SMB or WebDAV share, trick the victim into opening .pdf file and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Update Adobe Reader and Adobe Acrobat 8.1.7 or earlier to version 8.2.
Update Adobe Reader and Adobe Acrobat 9.2 or earlier to version 9.3.

http://get.adobe.com/reader
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=158&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=112&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh

• http://www.adobe.com/support/security/bulletins/apsb10-02.html