Security bypass in Adobe Acrobat - CVE-2009-3461

Vulnerability identifier: #VU2672

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2009-3461

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to insufficient access controls that leads to file extension security controls bypass.

Succesful exploitation of the vulnerability results in file-extension restrictions bypass on the vulnerable system.

Adobe Acrobat

Update Adobe Acrobat for Windows and Macintosh to version 9.2:
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=158&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=112&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh

• http://www.adobe.com/support/security/bulletins/apsb09-15.html

• Multiple vulnerabilities in Adobe Reader and Adobe Acrobat