Detections
Analytics
GLSA-200904-17 : Adobe Reader: User-assisted execution of arbitrary code
critical Nessus Plugin ID 36196
Language:
Synopsis
The remote Gentoo host is missing one or more security-related patches.Description
The remote host is affected by the vulnerability described in GLSA-200904-17 (Adobe Reader: User-assisted execution of arbitrary code)Multiple vulnerabilities have been discovered in Adobe Reader:
Alin Rad Pop of Secunia Research reported a heap-based buffer overflow when processing PDF files containing a malformed JBIG2 symbol dictionary segment (CVE-2009-0193).
A buffer overflow related to a non-JavaScript function call and possibly an embedded JBIG2 image stream has been reported (CVE-2009-0658).
Tenable Network Security reported a stack-based buffer overflow that can be triggered via a crafted argument to the getIcon() method of a Collab object (CVE-2009-0927).
Sean Larsson of iDefense Labs reported a heap-based buffer overflow when processing a PDF file containing a JBIG2 stream with a size inconsistency related to an unspecified table (CVE-2009-0928).
Jonathan Brossard of the iViZ Security Research Team reported an unspecified vulnerability related to JBIG2 and input validation (CVE-2009-1061).
Will Dormann of CERT/CC reported a vulnerability lading to memory corruption related to JBIG2 (CVE-2009-1062).
Impact :
A remote attacker could entice a user to open a specially crafted PDF document, possibly leading to the execution of arbitrary code with the privileges of the user running the application, or a Denial of Service.
Workaround :
There is no known workaround at this time.
Solution
All Adobe Reader users should upgrade to the latest version:# emerge --sync # emerge --ask --oneshot --verbose '>=app-text/acroread-8.1.4'
See Also
Plugin Details
Severity: Critical
ID: 36196
File Name: gentoo_GLSA-200904-17.nasl
Version: 1.27
Type: local
Family: Gentoo Local Security Checks
Published: 4/21/2009
Updated: 3/28/2022
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.6
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:gentoo:linux:acroread, cpe:/o:gentoo:linux
Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/18/2009
CISA Known Exploited Vulnerability Due Dates: 4/15/2022
Exploitable With
CANVAS (CANVAS)
Core Impact
Metasploit (Adobe Collab.getIcon() Buffer Overflow)
Reference Information
CVE: CVE-2009-0193, CVE-2009-0658, CVE-2009-0927, CVE-2009-0928, CVE-2009-1061, CVE-2009-1062