Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka "Universal CSRF and session riding."

The Adobe Acrobat Reader has been updated to version 7.0.9.

For SUSE Linux Enterprise Server 9 this version now includes its own GLIB2, ATK, PANGO and GTK2 libraries, since Acroread 7.0.x requires a minimum level of GTK2 2.4.

This update also includes following security fixes :

  - A memory corruption problem was fixed in Adobe Acrobat     Reader can potentially lead to code execution.
    (CVE-2006-5857)

  - Universal cross-site request forgery (CSRF) problems     were fixed in the Acrobat Reader plugin which could be     exploited by remote attackers to conduct CSRF attacks     using any site that is providing PDFs. (CVE-2007-0044)

  - Cross-site scripting problems in the Acrobat Reader     plugin were fixed, which could be exploited by remote     attackers to conduct XSS attacks against any site that     is providing PDFs. (CVE-2007-0045)

  - A double free problem in the Acrobat Reader plugin was     fixed which could be used by remote attackers to     potentially execute arbitrary code. Note that all     platforms using Adobe Reader currently have counter     measures against such attack where it will just cause a     controlled abort(). (CVE-2007-0046)

  - CVE-2007-0047 and CVE-2007-0048 affect only Microsoft     Windows and Internet Explorer.

The version of Adobe Acrobat installed on the remote host is earlier than 6.0.6 / 7.0.9 / 8.0 and thus reportedly is affected by several security issues, including one that can lead to arbitrary code execution when processing a malicious PDF file.

Updated acroread packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Adobe Reader allows users to view and print documents in portable document format (PDF).

Several flaws were found in the way Adobe Reader processed malformed PDF files. An attacker could create a malicious PDF file which could execute arbitrary code if opened by a victim. (CVE-2007-5659, CVE-2007-5663, CVE-2007-5666, CVE-2008-0726)

A flaw was found in the way the Adobe Reader browser plug-in honored certain requests. A malicious PDF file could cause the browser to request an unauthorized URL, allowing for a cross-site request forgery attack. (CVE-2007-0044)

A flaw was found in Adobe Reader's JavaScript API DOC.print function.
A malicious PDF file could silently trigger non-interactive printing of the document, causing multiple copies to be printed without the users consent. (CVE-2008-0667)

Additionally, this update fixes multiple unknown flaws in Adobe Reader. When the information regarding these flaws is made public by Adobe, it will be added to this advisory. (CVE-2008-0655)

Note: Adobe have yet to release security fixed versions of Adobe 7.
All users of Adobe Reader are, therefore, advised to install these updated packages. They contain Adobe Reader version 8.1.2, which is not vulnerable to these issues.

The Adobe Acrobat Reader (Japanese version) has been updated to version 7.0.9.

This update also includes following security fixes :

  - A memory corruption problem was fixed in Adobe Acrobat     Reader can potentially lead to code execution.
    (CVE-2006-5857)

  - Universal cross-site request forgery (CSRF) problems     were fixed in the Acrobat Reader plugin which could be     exploited by remote attackers to conduct CSRF attacks     using any site that is providing PDFs. (CVE-2007-0044)

  - Cross-site scripting problems in the Acrobat Reader     plugin were fixed, which could be exploited by remote     attackers to conduct XSS attacks against any site that     is providing PDFs. (CVE-2007-0045)

  - A double free problem in the Acrobat Reader plugin was     fixed which could be used by remote attackers to     potentially execute arbitrary code. Note that all     platforms using Adobe Reader currently have counter     measures against such attack where it will just cause a     controlled abort(). (CVE-2007-0046)

The Adobe Acrobat Reader has been updated to version 7.0.9.

This update also includes following security fixes :

  - A memory corruption problem was fixed in Adobe Acrobat     Reader can potentially lead to code execution.
    (CVE-2006-5857)

  - Universal cross-site request forgery (CSRF) problems     were fixed in the Acrobat Reader plugin which could be     exploited by remote attackers to conduct CSRF attacks     using any site that is providing PDFs. (CVE-2007-0044)

  - Cross-site scripting problems in the Acrobat Reader     plugin were fixed, which could be exploited by remote     attackers to conduct XSS attacks against any site that     is providing PDFs. (CVE-2007-0045)

  - A double free problem in the Acrobat Reader plugin was     fixed which could be used by remote attackers to     potentially execute arbitrary code. Note that all     platforms using Adobe Reader currently have counter     measures against such attack where it will just cause a     controlled abort(). (CVE-2007-0046)

The Adobe Acrobat Reader has been updated to version 7.0.9.

This update also includes following security fixes :

CVE-2006-5857: A memory corruption problem was fixed in Adobe Acrobat Reader can potentially lead to code execution.

CVE-2007-0044: Universal Cross Site Request Forgery (CSRF) problems were fixed in the Acrobat Reader plugin which could be exploited by remote attackers to conduct CSRF attacks using any site that is providing PDFs.

CVE-2007-0045: Cross site scripting problems in the Acrobat Reader plugin were fixed, which could be exploited by remote attackers to conduct XSS attacks against any site that is providing PDFs.

CVE-2007-0046: A double free problem in the Acrobat Reader plugin was fixed which could be used by remote attackers to potentially execute arbitrary code. Note that all platforms using Adobe Reader currently have counter measures against such attack where it will just cause a controlled abort().

CVE-2007-0047 and CVE-2007-0048 affect only Microsoft Windows and Internet Explorer.

The remote host is affected by the vulnerability described in GLSA-200701-16 (Adobe Acrobat Reader: Multiple vulnerabilities)

    Adobe Acrobat Reader in stand-alone mode is vulnerable to remote code     execution via heap corruption when loading a specially crafted PDF     file.
    The browser plugin released with Adobe Acrobat Reader (nppdf.so) does     not properly handle URLs, and crashes if given a URL that is too long.
    The plugin does not correctly handle JavaScript, and executes     JavaScript that is given as a GET variable to the URL of a PDF file.
    Lastly, the plugin does not properly handle the FDF, xml, xfdf AJAX     request parameters following the # character in a URL, allowing for     multiple cross-site scripting vulnerabilities.
  Impact :

    An attacker could entice a user to open a specially crafted PDF file     and execute arbitrary code with the rights of the user running Adobe     Acrobat Reader. An attacker could also entice a user to browse to a     specially crafted URL and either crash the Adobe Acrobat Reader browser     plugin, execute arbitrary JavaScript in the context of the user's     browser, or inject arbitrary HTML or JavaScript into the document being     viewed by the user. Note that users who have emerged Adobe Acrobat     Reader with the 'nsplugin' USE flag disabled are not vulnerable to     issues with the Adobe Acrobat Reader browser plugin.
  Workaround :

    There is no known workaround at this time.

The version of Adobe Reader installed on the remote host is earlier than 7.0.9 / 8.0 and is, therefore, reportedly affected by several security issues, including one that can lead to arbitrary code execution when processing a malicious PDF file.

The version of Adobe PDF Plug-In installed on the remote host is earlier than 8.0 / 7.0.9 / 6.0.6 and reportedly fails to properly sanitize input to the 'FDF', 'XML', or 'XFDF' fields used by its 'Open Parameters' feature. By tricking a user into accessing a specially crafted link and depending on the browser with which the plugin is used, a remote attacker may be able to leverage these issues to conduct arbitrary code execution, denial of service, cross-site script forgery, or cross-site scripting attacks against a user on the remote host.

The version of Google Chrome installed on the remote host is earlier than 1.0.154.46.  Such versions are reportedly affected by several issues : 

  - Cross-site scripting vulnerabilities in the Adobe Reader Plugin itself could be leveraged using a PDF document to run scripts on arbitrary sites via Google Chrome.  (CVE-2007-0048 and CVE-2007-0045)

  - A cross-domain security bypass vulnerability that could allow an attacker to bypass the same-origin policy and gain access to potentially sensitive information. (CVE-2009-0276)

ID	Name	Product	Family	Severity
41117	SuSE9 Security Update : acroread (YOU Patch Number 11433)	Nessus	SuSE Local Security Checks	high
40798	Adobe Acrobat < 6.0.6 / 7.0.9 Multiple Vulnerabilities	Nessus	Windows	high
40715	RHEL 3 / 4 / 5 : acroread (RHSA-2008:0144)	Nessus	Red Hat Local Security Checks	high
29371	SuSE 10 Security Update : acroread_ja (ZYPP Patch Number 2545)	Nessus	SuSE Local Security Checks	high
29370	SuSE 10 Security Update : acroread (ZYPP Patch Number 2508)	Nessus	SuSE Local Security Checks	high
27144	openSUSE 10 Security Update : acroread (acroread-2506)	Nessus	SuSE Local Security Checks	high
24252	GLSA-200701-16 : Adobe Acrobat Reader: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
24002	Adobe Reader < 6.0.6 / 7.0.9 Multiple Vulnerabilities	Nessus	Windows	high
23975	Adobe PDF Plug-In < 8.0 / 7.0.9 / 6.0.6 Multiple Vulnerabilities (APSB07-01)	Nessus	Windows	high
800951	Google Chrome < 1.0.154.46 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	medium

Detections

Analytics

CVE-2007-0044

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

medium