Multiple vulnerabilities have been identified in Adobe Reader and Acrobat, which could be exploited by attackers to bypass security restrictions, gain knowledge of sensitive information, cause a denial of service or compromise a vulnerable system. These issues are caused by memory corruptions, integer and heap overflows, and array indexing and input validation errors when processing malformed data, which could be exploited by attackers to disclose sensitive information, spoof data, crash an affected application, or execute arbitrary code by tricking a user into opening a specially crafted PDF document or visiting a malicious web page.
Affected Products
Adobe Reader version 9.1.3 and prior (Windows, Macintosh, and UNIX)
Adobe Reader version 8.1.6 and prior (Windows, Macintosh, and UNIX)
Adobe Reader version 7.1.3 and prior (Windows and Macintosh)
Adobe Acrobat version 9.1.3 and prior (Windows, Macintosh, and UNIX)
Adobe Acrobat version 8.1.6 and prior (Windows, Macintosh, and UNIX)
Adobe Acrobat version 7.1.3 and prior (Windows and Macintosh)
Solution
Upgrade to Adobe Acrobat and Reader versions 9.2, 8.1.7, or 7.1.4 :
http://www.adobe.com/go/gntray_prod_acrobat_family_home
References
http://www.vupen.com/english/advisories/2009/2898
http://www.adobe.com/support/security/bulletins/apsb09-15.html
Credits
Vulnerabilities reported by Nicolas Joly (VUPEN Security), Michael Schmidt (Compass Security), Didier Stevens, Drew Yao (Apple Product Security), Stefano Di Paola (Minded Security), Guillaume Delugré and Frédéric Raynal (SOGETI ESEC), SkyLined (Google Inc.), Tavis Ormandy (Google Security Team), TippingPoint Zero Day Initiative, Will Dormann (CERT), Zhenhua Liu, Xiaopeng Zhang and Haifei Li (Fortinet FortiGuard Global Security Research Team), Tielei Wang (ICST-ERCIS), Dionysus Blazakis and Elazar Broad via iDefense, David Soldera (Next Generation Security Software), IOActive, Felipe Andres Manzano via iSIGHT Partners GVP, and Chia-Ching Fang (Information and Communication Security Technology Center).
ChangeLog
2009-10-13 : Initial release
Vulnerability Management
Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form.
