Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

The acroread packages as shipped in Red Hat Enterprise Linux 3 Extras contain security flaws and should not be used.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Adobe Reader allows users to view and print documents in Portable Document Format (PDF).

Adobe Reader 8.1.7 is vulnerable to critical security flaws and should no longer be used. A specially crafted PDF file could cause Adobe Reader to crash or, potentially, execute arbitrary code as the user running Adobe Reader when opened. (CVE-2009-4324, CVE-2009-3953, CVE-2009-3954, CVE-2009-3955, CVE-2009-3959, CVE-2009-3956)

Adobe have discontinued support for Adobe Reader 8 for Linux. Adobe Reader 9 for Linux is not compatible with Red Hat Enterprise Linux 3.
An alternative PDF file viewer available in Red Hat Enterprise Linux 3 is xpdf.

This update removes the acroread packages due to their known security vulnerabilities.

Updated acroread packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 Extras.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Adobe Reader allows users to view and print documents in Portable Document Format (PDF).

This update fixes several vulnerabilities in Adobe Reader. These vulnerabilities are summarized on the Adobe Security Advisory APSB10-02 page listed in the References section. A specially crafted PDF file could cause Adobe Reader to crash or, potentially, execute arbitrary code as the user running Adobe Reader when opened.
(CVE-2009-4324, CVE-2009-3953, CVE-2009-3954, CVE-2009-3955, CVE-2009-3959, CVE-2009-3956)

Adobe have discontinued support for Adobe Reader 8 for Linux. All users of Adobe Reader are advised to install these updated packages, which contain Adobe Reader version 9.3, which is not vulnerable to these issues. All running instances of Adobe Reader must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0037 advisory.

  - acroread: multiple code execution flaws (APSB10-02) (CVE-2009-3953, CVE-2009-3954, CVE-2009-3955,     CVE-2009-3959)

  - acroread: script injection vulnerability (APSB10-02) (CVE-2009-3956)

  - acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02) (CVE-2009-4324)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Specially crafted PDF files could crash acroread. Attackers could exploit that to potentially execute arbitrary code. (CVE-2009-3953 / CVE-2009-3954 / CVE-2009-3955 / CVE-2009-3956 / CVE-2009-3957 / CVE-2009-3958 / CVE-2009-3959 / CVE-2009-4324)

Specially crafted PDF files could crash acroread. Attackers could exploit that to potentially execute arbitrary code. (CVE-2009-3953 / CVE-2009-3954 / CVE-2009-3955 / CVE-2009-3956 / CVE-2009-3957 / CVE-2009-3958 / CVE-2009-3959 / CVE-2009-4324)

Acrobat reader was updated to version 9.3 to fix those security issues.

The remote host is affected by the vulnerability described in GLSA-201009-05 (Adobe Reader: Multiple vulnerabilities)

    Multiple vulnerabilities were discovered in Adobe Reader. For further     information please consult the CVE entries and the Adobe Security     Bulletins referenced below.
  Impact :

    A remote attacker might entice a user to open a specially crafted PDF     file, possibly resulting in the execution of arbitrary code with the     privileges of the user running the application, or bypass intended     sandbox restrictions, make cross-domain requests, inject arbitrary web     script or HTML, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Specially crafted PDF files could crash acroread. Attackers could exploit that to potentially execute arbitrary code (CVE-2009-3953, CVE-2009-3954, CVE-2009-3955, CVE-2009-3956, CVE-2009-3957, CVE-2009-3958, CVE-2009-3959, CVE-2009-4324).

Acrobat reader was updated to version 9.3 to fix those security issues.

The version of Adobe Reader installed on the remote host is earlier than 9.3 / 8.2.  Such versions are reportedly affected by multiple vulnerabilities :

  - A use-after-free vulnerability in 'Multimedia.api' can     lead to code execution. (CVE-2009-4324)

  - An array boundary issue in 'U3D' support can lead to     code execution. (CVE-2009-3953)

  - A DLL-loading vulnerability in '3D' can allow arbitrary     code execution. (CVE-2009-3954)

  - A memory corruption vulnerability can lead to code     execution. (CVE-2009-3955)

  - A script injection vulnerability. (CVE-2009-3956)

  - A NULL pointer dereference vulnerability can lead to a     denial of service. (CVE-2009-3957)

  - A buffer overflow vulnerability in the Download Manager     can lead to code execution. (CVE-2009-3958)

  - An integer overflow vulnerability in 'U3D' support can     lead to code execution. (CVE-2009-3959)

  - A buffer overflow in the 'gp.ocx' ActiveX control can     lead to code execution. (CVE-2010-1278)

The version of Adobe Acrobat installed on the remote host is earlier than 9.3 / 8.2.  Such versions are reportedly affected by multiple vulnerabilities :

  - A use-after-free vulnerability in 'Multimedia.api' can     lead to code execution. (CVE-2009-4324)

  - An array boundary issue in 'U3D' support can lead to     code execution. (CVE-2009-3953)

  - A DLL-loading vulnerability in '3D' can allow arbitrary     code execution. (CVE-2009-3954)

  - A memory corruption vulnerability can lead to code     execution. (CVE-2009-3955)

  - A script injection vulnerability. (CVE-2009-3956)

  - A NULL pointer dereference vulnerability can lead to a     denial of service. (CVE-2009-3957)

  - A buffer overflow vulnerability in the Download Manager     can lead to code execution. (CVE-2009-3958)

  - An integer overflow vulnerability in 'U3D' support can     lead to code execution. (CVE-2009-3959)

  - A buffer overflow in the 'gp.ocx' ActiveX control can     lead to code execution. (CVE-2010-1278)

ID	Name	Product	Family	Severity
63914	RHEL 3 : acroread (RHSA-2010:0060)	Nessus	Red Hat Local Security Checks	critical
63912	RHEL 4 : acroread (RHSA-2010:0038)	Nessus	Red Hat Local Security Checks	critical
63911	RHEL 5 : acroread (RHSA-2010:0037)	Nessus	Red Hat Local Security Checks	high
51711	SuSE 10 Security Update : acroread_ja (ZYPP Patch Number 6805)	Nessus	SuSE Local Security Checks	critical
51710	SuSE 10 Security Update : acroread_ja (ZYPP Patch Number 6804)	Nessus	SuSE Local Security Checks	critical
51696	SuSE 10 Security Update : acroread (ZYPP Patch Number 6803)	Nessus	SuSE Local Security Checks	critical
51695	SuSE 10 Security Update : acroread (ZYPP Patch Number 6802)	Nessus	SuSE Local Security Checks	critical
49126	GLSA-201009-05 : Adobe Reader: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
44377	SuSE 11 Security Update : acroread_ja (SAT Patch Number 1881)	Nessus	SuSE Local Security Checks	critical
44130	SuSE 11 Security Update : Acrobat Reader (SAT Patch Number 1850)	Nessus	SuSE Local Security Checks	critical
44128	openSUSE Security Update : acroread (acroread-1849)	Nessus	SuSE Local Security Checks	critical
44126	openSUSE Security Update : acroread (acroread-1849)	Nessus	SuSE Local Security Checks	critical
44124	openSUSE Security Update : acroread (acroread-1849)	Nessus	SuSE Local Security Checks	critical
43876	Adobe Reader < 9.3 / 8.2 Multiple Vulnerabilities (APSB10-02)	Nessus	Windows	critical
43875	Adobe Acrobat < 9.3 / 8.2 Multiple Vulnerabilities (APSB10-02)	Nessus	Windows	critical

Detections

Analytics

CVE-2009-4324

high

Tenable Plugins

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical