Denial of service in Adobe Acrobat and Adobe Reader - CVE-2009-2988

Vulnerability identifier: #VU2657

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2009-2988

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS conditions on the target system.

The weakness exists due to an error in ActiveX control. By sending a specially crafted .pdf file, a remote attacker can cause the application to crash.

Successful exploitation of the vulnerability may result in denial of service.

Adobe Acrobat
Adobe Reader
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop

Update Adobe Reader for Windows, Macintosh, and UNIX to version 9.2:
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Macintosh
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Unix
Update Adobe Acrobat for Windows and Macintosh to version 9.2:
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=158&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=112&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh

• http://www.adobe.com/support/security/bulletins/apsb09-15.html

• Multiple vulnerabilities in Adobe Reader and Adobe Acrobat
• Gentoo update for Adobe Reader
• openSUSE update for flash-player
• Red Hat update for acroread