Detections
Analytics
Adobe Acrobat < 9.2 / 8.1.7 / 7.1.4 Multiple Vulnerabilities (APSB09-15)
high Nessus Plugin ID 42119
Synopsis
The version of Adobe Acrobat on the remote Windows host is affected by multiple vulnerabilities.Description
The version of Adobe Acrobat installed on the remote host is earlier than 9.2 / 8.1.7 / 7.1.4. Such versions are reportedly affected by multiple vulnerabilities :- A heap overflow vulnerability. (CVE-2009-3459)
- A memory corruption issue. (CVE-2009-2985)
- Multiple heap overflow vulnerabilities. (CVE-2009-2986)
- An invalid array index issue that could lead to code execution. (CVE-2009-2990)
- Multiple input validation vulnerabilities that could lead to code execution. (CVE-2009-2993)
- A buffer overflow issue. (CVE-2009-2994)
- A heap overflow vulnerability. (CVE-2009-2997)
- An input validation issue that could lead to code execution. (CVE-2009-2998)
- An input validation issue that could lead to code execution. (CVE-2009-3458)
- A memory corruption issue. (CVE-2009-3460)
- An issue that could allow a malicious user to bypass file extension security controls. (CVE-2009-3461)
- An integer overflow vulnerability. (CVE-2009-2989)
- A memory corruption issue that leads to a denial of service. (CVE-2009-2983)
- An integer overflow that leads to a denial of service.
(CVE-2009-2980)
- A memory corruption issue that leads to a denial of service. (CVE-2009-2996)
- An image decoder issue that leads to a denial of service.
(CVE-2009-2984)
- An input validation issue that could lead to a bypass of Trust Manager restrictions. (CVE-2009-2981)
- A certificate is used that, if compromised, could be used in a social engineering attack. (CVE-2009-2982)
- A stack overflow issue that could lead to a denial of service. (CVE-2009-3431)
- A XMP-XML entity expansion issue that could lead to a denial of service attack. (CVE-2009-2979)
- A remote denial of service issue in the ActiveX control.
(CVE-2009-2987)
- An input validation issue. (CVE-2009-2988)
- An input validation issue specific to the ActiveX control. (CVE-2009-2992)
- A cross-site scripting issue when the browser plugin in used with Google Chrome and Opera browsers. (CVE-2007-0048, CVE-2007-0045)
Solution
Upgrade to Adobe Acrobat 9.2 / 8.1.7 / 7.1.4 or later.See Also
http://www.adobe.com/support/security/bulletins/apsb09-15.html
Plugin Details
Severity: High
ID: 42119
File Name: adobe_acrobat_apsb09-15.nasl
Version: 1.17
Type: local
Agent: windows
Family: Windows
Published: 10/14/2009
Updated: 6/27/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.4
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 8.1
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:adobe:acrobat
Required KB Items: SMB/Acrobat/Version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 10/13/2009
Vulnerability Publication Date: 10/9/2009
Exploitable With
Core Impact
Metasploit (Adobe FlateDecode Stream Predictor 02 Integer Overflow)
Reference Information
CVE: CVE-2007-0045, CVE-2007-0048, CVE-2009-2979, CVE-2009-2980, CVE-2009-2981, CVE-2009-2982, CVE-2009-2983, CVE-2009-2984, CVE-2009-2985, CVE-2009-2986, CVE-2009-2987, CVE-2009-2988, CVE-2009-2989, CVE-2009-2990, CVE-2009-2991, CVE-2009-2992, CVE-2009-2993, CVE-2009-2994, CVE-2009-2995, CVE-2009-2996, CVE-2009-2997, CVE-2009-2998, CVE-2009-3431, CVE-2009-3458, CVE-2009-3459, CVE-2009-3460, CVE-2009-3461
BID: 21858, 36600, 36664, 36665, 36667, 36668, 36669, 36671, 36677, 36678, 36680, 36681, 36682, 36683, 36686, 36687, 36688, 36689, 36690, 36691, 36692, 36693, 36694, 36695, 36697