Adobe Acrobat 9 <= 9.4 (APSA10-05)

This script is Copyright (C) 2010-2012 Tenable Network Security, Inc.


Synopsis :

The version of Adobe Acrobat on the remote Windows host is affected by
a code execution vulnerability.

Description :

The remote Windows host contains Adobe Acrobat version 9.4 or
earlier. Such versions are affected by an unspecified memory
corruption vulnerability.

A remote attacker could exploit this issue by getting a user to open a
maliciously crafted PDF containing SWF content, resulting in the
execution of arbitrary code.

This vulnerability is reportedly being exploited in the wild.

See also :

http://www.adobe.com/support/security/advisories/apsa10-05.html

Solution :

Upgrade to the latest version when it is released. Adobe states it
will be released the week of November 15, 2010.

In the meantime, deleting or renaming the version of 'authplay.dll'
that ships with Adobe Acrobat will result in a non-exploitable crash
when opening PDFs containing SWF content.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
Public Exploit Available : true

Family: Windows

Nessus Plugin ID: 50380 ()

Bugtraq ID: 44504

CVE ID: CVE-2010-3654

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now