Detections
Analytics
Adobe Acrobat < 8.1.2 / 7.1.0 Multiple Vulnerabilities
high Nessus Plugin ID 40800
Synopsis
The version of Adobe Acrobat on the remote Windows host is affected by multiple vulnerabilities.Description
The version of Adobe Acrobat installed on the remote host is earlier than 8.1.2 or 7.1.0. Such versions are reportedly affected by multiple vulnerabilities :- A design error vulnerability may allow an attacker to gain control of a user's printer.
- Multiple stack-based buffer overflows may allow an attacker to execute arbitrary code subject to the user's privileges.
- Insecure loading of 'Security Provider' libraries may allow for arbitrary code execution.
- An insecure method exposed by the JavaScript library in the 'EScript.api' plug-in allows direct control over low-level features of the object, which allows for execution of arbitrary code as the current user.
- Two vulnerabilities in the unpublicized function 'app.checkForUpdate()' exploited through a callback function could lead to arbitrary code execution in Adobe Acrobat 7.
Solution
Upgrade to Adobe Acrobat 8.1.2 / 7.1.0 or later.See Also
https://www.adobe.com/support/security/advisories/apsa08-01.html
https://www.adobe.com/support/security/bulletins/apsb08-13.html
Plugin Details
Severity: High
ID: 40800
File Name: adobe_acrobat_812.nasl
Version: 1.17
Type: local
Agent: windows
Family: Windows
Published: 8/28/2009
Updated: 6/8/2022
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.6
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 8.1
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2008-2042
Vulnerability Information
CPE: cpe:/a:adobe:acrobat
Required KB Items: SMB/Acrobat/Version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/16/2008
Vulnerability Publication Date: 2/7/2008
CISA Known Exploited Vulnerability Due Dates: 6/22/2022
Exploitable With
CANVAS (CANVAS)
Core Impact
Metasploit (Adobe Collab.collectEmailInfo() Buffer Overflow)
Reference Information
CVE: CVE-2007-5659, CVE-2007-5663, CVE-2007-5666, CVE-2008-0655, CVE-2008-0667, CVE-2008-0726, CVE-2008-2042
BID: 27641