Denial of service in Adobe Reader and Adobe Acrobat - CVE-2009-3431

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU2669

Denial of service in Adobe Reader and Adobe Acrobat - CVE-2009-3431

Published: December 22, 2016 / Updated: September 14, 2018


Vulnerability identifier: #VU2669
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2009-3431
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vendor: Adobe
Affected software:
Adobe Reader
Adobe Acrobat

Detailed vulnerability description

The vulnerability allows a remote attacker to cause DoS conditions on the target system.

The weakness exists due to stack consumption when handling malformed documents. A remote attacker can create a specially crafted PDF file with a large number of [ (open square bracket) characters in the argument to the alert method, trick the victim into opening it, trigger memory  cause the affected application to crash.

Successful exploitation of the vulnerability may result in denial of service on the vulnerable system.

How to mitigate CVE-2009-3431


Sources