Vulnerability identifier: #VU2669
Vulnerability risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-119
Exploitation vector: Network
Exploit availability: Yes
Vulnerable software:
Adobe Reader
Client/Desktop applications /
Office applications
Adobe Acrobat
Client/Desktop applications /
Office applications
Vendor: Adobe
Description
The vulnerability allows a remote attacker to cause DoS conditions on the target system.
The weakness exists due to stack consumption when handling malformed documents. A remote attacker can create a specially crafted PDF file with a large number of [ (open square bracket) characters in the argument to the alert method, trick the victim into opening it, trigger memory cause the affected application to crash.
Successful exploitation of the vulnerability may result in denial of service on the vulnerable system.
Mitigation
Update Adobe Reader for Windows, Macintosh, and UNIX to version 9.2:
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Macintosh
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Unix
Update Adobe Acrobat for Windows and Macintosh to version 9.2:
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=158&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=112&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh
Vulnerable software versions
Adobe Reader: 8.0 - 8.3.1, 7.0 - 7.0.9, 9.0 - 9.1.3
Adobe Acrobat: 7.0 - 7.0.9, 8.0 - 8.3.1, 9.0 - 9.1.3
External links
http://www.adobe.com/support/security/bulletins/apsb09-15.html
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.