Search:

May 2008

3611 - Security Updates available for Adobe Reader and Acrobat 7 and 8

ID: 3611
Date: 07/05/2008

Title: 3611 - Security Updates available for Adobe Reader and Acrobat 7 and 8
Platform level affected:Net Application - Client
Specific operating systems components affected: 32-bit Windows
Net-enabled software: Enterprise Application
Remediation Summary:Update your copy of the software with the download available from the supplier.
Vendors affected:Adobe
Applications affected:Adobe Reader 8.1.1 and earlier versions Adobe Acrobat Professional, 3D and Standard 8.1.1 and earlier versions.
Adversity source: Unknown
Attack Vector: Vulnerability exploitation
Virulence: Proof of Concept
Warning Status: Proof of concept
Potential Damage: Remote execution/modification
Possible Duration: Unknown
Availability of fix: Available
Type of fix: Patch
Source: Adobe
Reliability of source: Trusted
Source URL: http://www.adobe.com/support/security/bulletins/apsb08-13.html
CVE: CVE-2008-0667, CVE-2007-5666, CVE-2007-5659, CVE-2007-5663, CVE-2008-0726, CVE-2008-0655, CVE-2008-2042, CVE-2007-4768
Abstract: Critical vulnerabilities have been identified in Adobe Reader and Acrobat 8.1.1 and earlier versions. These vulnerabilities would cause the application to crash and could potentially allow an attacker to take control of the affected system. Adobe categorizes this as a critical issue and recommends that users apply the update for their product installations.

Security Updates available for Adobe Reader and Acrobat 7 and 8
Release date: May 6, 2008

Vulnerability identifier: APSB08-13

CVE number: CVE-2008-0667, CVE-2007-5666, CVE-2007-5659, CVE-2007-5663, CVE-2008-0726, CVE-2008-0655, CVE-2008-2042, CVE-2007-4768

Platform: All Platforms

Affected software versions: Adobe Reader 8.1.1 and earlier versions Adobe Acrobat Professional, 3D and Standard 8.1.1 and earlier versions.

Summary
Critical vulnerabilities have been identified in Adobe Reader and Acrobat 8.1.1 and earlier versions. These vulnerabilities would cause the application to crash and could potentially allow an attacker to take control of the affected system.

Adobe recommends users of Acrobat 8 and Adobe Reader install the 8.1.2 update and users of Acrobat 7 install the 7.1.0 update to protect themselves from potential vulnerabilities. This is an update to resolve the issues previously reported in Security Advisory APSA08-01.

Solution
Acrobat 8 and Adobe Reader
Adobe recommends Adobe Reader 7 and 8 users update to Adobe Reader 8.1.2, available here: http://www.adobe.com/go/getreader.

Adobe recommends Acrobat 8 users on Windows update to Acrobat 8.1.2, available here: http://www.adobe.com/support/downloads/detail.jsp?ftpID=3849.

Adobe recommends Acrobat 8 users on Macintosh update to Acrobat 8.1.2, available here: http://www.adobe.com/support/downloads/detail.jsp?ftpID=3856.

Adobe recommends Acrobat 3D version 8 users on Windows update to Acrobat 3D version 8.1.2, available here: http://www.adobe.com/support/downloads/detail.jsp?ftpID=3850.

Users with Adobe Reader 7.0 through 7.0.9, who cannot upgrade to Reader 8.1.2, should upgrade to Reader 7.1.0: http://www.adobe.com/go/getreader.

Acrobat 7
Adobe recommends Acrobat 7 users on Windows update to Acrobat 7.1.0, available here: http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows.

Adobe recommends Acrobat 8 users on Macintosh update to Acrobat 7.1.0, available here: http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh.

Details
Critical vulnerabilities have been identified in Adobe Reader and Acrobat 8.1.1 and earlier versions. These vulnerabilities would cause the application to crash and could potentially allow an attacker to take control of the affected system.

Adobe recommends users of Acrobat and Adobe Reader update their product installations using the instructions above to protect themselves from potential vulnerabilities.

This update resolves an input validation issue in several JavaScript methods that could potentially lead to remote code execution. (CVE-2007-5659)
NOTE: There are reports that this issue is being exploited.

This update resolves an input validation issue in that could potentially lead to remote code execution. (CVE-2007-4768)

The Acrobat 7.1.0 update resolves an input validation issue in a JavaScript method that could potentially lead to remote code execution. (CVE-2008-2042)

The Acrobat 7.1.0 and Acrobat 8.1.2 updates resolve an input validation issue in that could potentially lead to code execution.

This update resolves an issue with an insecure JavaScript method that could potentially lead to remote code execution. (CVE-2007-5663)

This update resolves an integer overflow issue in a JavaScript function that could potentially allow remote code execution. (CVE-2008-0726)

This update resolves a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times. (CVE-2008-0655)

This update resolves an issue that could allow a local user to execute arbitrary code by overwriting a local file. (CVE-2007-5666)

Severity rating
Adobe categorizes this as an critical issue and recommends that users apply the update for their product installations.

Acknowledgments
Adobe would like to thank the following individuals and organizations for reporting the relevant issues and for working with Adobe to help protect our customers' security:

Tavis Ormandy and Will Drewry of the Google Security Team (CVE-2007- 4768)
cocoruder of Fortinet Security Research Team (CVE-2008-0655, CVE-2008-2042)
Greg MacManus of iDefense Labs (CVE-2007-5659, CVE-2007-5663, CVE-2007-5666)
Paul Craig of Security-Assessment.com
An anonymous researcher reported through TippingPoint's Zero Day Initiative (CVE-2008-0726)

This advisory contains information released by the original author. Some of the information may have changed since it was released. If the issue affects you, it may be prudent to retrieve the advisory from the site of the original source to ensure that you receive the most current information concerning that problem. Reference to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favouring by CPNI.

The views and opinions of authors expressed within this notice shall not be used for advertising or product endorsement purposes. CPNI shall not accept responsibility for any errors or omissions contained within this advisory. In particular, they shall not be liable for any loss or damage whatsoever, arising from or in connection with the usage of information contained within this advisory.

CSIRTUK is a member of the Forum of Incident Response and Security Teams (FIRST) and has contacts with other international Incident Response Teams (IRTs) in order to foster cooperation and coordination in incident prevention, to prompt rapid reaction to incidents, and to promote information sharing amongst its members and the community at large.