Technical Description

Two vulnerabilities have been identified in Adobe Reader and Acrobat, which could be exploited by attackers to compromise a vulnerable system.

The first issue is caused by a memory corruption error when processing specially crafted data passed to the "getAnnots()" JavaScript method, which could be exploited by attackers to crash an affected application or execute arbitrary code by tricking a user into opening a malicious PDF file.

The second vulnerability is caused by a memory corruption error when processing specially crafted data passed to the "customDictionaryOpen()" JavaScript method, which could be exploited by attackers to crash an affected application or execute arbitrary code by tricking a user into opening a malicious PDF file.

Affected Products

Adobe Reader version 9.1 and prior
Adobe Reader version 8.1.4 and prior
Adobe Reader version 7.1.1 and prior
Adobe Acrobat version 9.1 and prior
Adobe Acrobat version 8.1.4 and prior
Adobe Acrobat version 7.1.1 and prior

Solution

Upgrade to Adobe Acrobat and Reader versions 9.1.1, 8.1.5, or 7.1.2 :
http://www.adobe.com/support/security/bulletins/apsb09-06.html

Adobe Acrobat and Reader 7 updates for Macintosh will be available before the end of June.

References

http://www.vupen.com/english/advisories/2009/1189
http://www.adobe.com/support/security/bulletins/apsb09-06.html
http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html
http://packetstormsecurity.nl/0904-exploits/getannots.txt
http://packetstormsecurity.nl/0904-exploits/spell.txt

Credits

Vulnerabilities reported by Arr1val.

ChangeLog

2009-04-28 : Initial release
2009-04-28 : Updated Description
2009-05-12 : Updated Solution

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.