Adobe Acrobat < 7.1.0 / 8.1.2 Unspecified JavaScript Method Handling Arbitrary Code Execution

high Nessus Plugin ID 40801

Synopsis

The version of Adobe Acrobat on the remote Windows host is affected by a JavaScript parsing vulnerability.

Description

The version of Adobe Acrobat installed on the remote Windows host contains a flaw in the 'Collab.collectEmailInfo()' function that may allow a remote attacker to crash the application or to take control of the affected system.

To exploit this flaw, an attacker would need to trick a user on the affected system into opening a specially crafted PDF file using the affected application.

Solution

Upgrade to Adobe Acrobat 7.1.0 / 8.1.2 with Security Update 1 or later.

See Also

https://www.adobe.com/support/security/bulletins/apsb08-15.html

Plugin Details

Severity: High

ID: 40801

File Name: adobe_acrobat_812_su1.nasl

Version: 1.13

Type: local

Agent: windows

Family: Windows

Published: 8/28/2009

Updated: 11/15/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:adobe:acrobat

Required KB Items: SMB/Acrobat/Version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/23/2008

Vulnerability Publication Date: 6/23/2008

Reference Information

CVE: CVE-2008-2641

BID: 29908

Secunia: 30832