ID: 3850
Date: 12/06/2009
Title: 3850 - Adobe Acrobat and Reader Vulnerabilities
Platform level affected:Net Application - Client
Hardware components affected:Intel PC
Specific operating systems components affected: 32-bit Windows
Other software: Generic Document Format
Remediation Summary:Update your copy of the software with the download available from the supplier.
Vendors affected:Adobe
Applications affected:Adobe Acrobat and Reader
Adversity source: Unknown
Attack Vector: Vulnerability exploitation
Virulence: Unknown
Warning Status: Active
Potential Damage: Privilege escalation
Possible Duration: Unknown
Availability of fix: Available
Type of fix: Patch
Source: US-CERT, Adobe
Reliability of source: Trusted
Source URL: http://www.adobe.com/support/security/bulletins/apsb09-07.html
Abstract: Adobe has released Security Bulletin APSB09-07, which describes several buffer overflow vulnerabilities that could allow a remote attacker to execute arbitrary code.
National Cyber Alert System
Technical Cyber Security Alert TA09-161A
Adobe Acrobat and Reader Vulnerabilities
Original release date: June 10, 2009
Last revised: --
Source: US-CERT
Systems Affected
* Adobe Reader versions 9.1.1 and earlier, 8.1.5 and earlier, and 7.1.2 and earlier
* Adobe Acrobat (Standard, Professional, and 3D) versions 9.1.1 and earlier, 8.1.5 and earlier, and 7.1.2 and earlier
Overview
Adobe has released Security Bulletin APSB09-07, which describes
several buffer overflow vulnerabilities that could allow a remote
attacker to execute arbitrary code.
I. Description
Adobe Security Bulletin APSB09-07 describes several
memory-corruption vulnerabilities that affect Adobe Reader and
Acrobat. Some of these vulnerabilities occur when Adobe Reader and
Acrobat handle files with specially crafted JBIG2 streams. An
attacker could exploit these vulnerabilities by convincing a user
to load a specially crafted Adobe Portable Document Format (PDF)
file. Acrobat integrates with popular web browsers, and visiting a
website is usually sufficient to cause Acrobat to load PDF content.
II. Impact
An attacker may be able to execute arbitrary code.
III. Solution
Update
Adobe has released updates to address this issue. Users are
encouraged to read Adobe Security Bulletin APSB09-07 and update
vulnerable versions of Adobe Reader and Acrobat.
Disable JavaScript in Adobe Reader and Acrobat
Disabling Javascript may prevent some exploits from resulting in
code execution. Acrobat JavaScript can be disabled using the
Preferences menu:
* Open the Edit menu.
* Select Preferences.
* Choose JavaScript.
* Un-check Enable Acrobat JavaScript.
Prevent Internet Explorer from automatically opening PDF documents
The installer for Adobe Reader and Acrobat configures Internet
Explorer to automatically open PDF files without any user
interaction. This behavior can be reverted to the safer option of
prompting the user by importing the following as a .REG file:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\AcroExch.Document.7] "EditFlags"=hex:00,00,00,00
Disable the display of PDF documents in the web browser
Preventing PDF documents from opening inside a web browser will
partially mitigate this vulnerability. This workaround may also
mitigate future vulnerabilities.
To prevent PDF documents from automatically being opened in a web
browser, do the following:
* Open Adobe Acrobat Reader.
* Open the Edit menu.
* Choose the Preferences option.
* Choose the Internet section.
* Un-check the Display PDF in browser check box.
Do not access PDF documents from untrusted sources
Do not open unfamiliar or unexpected PDF documents, particularly
those hosted on websites or delivered as email attachments. See
Cyber Security Tip ST04-010.
Additional workarounds are available in Vulnerability Note
VU#568153.
IV. References
* Adobe Security Bulletin APSB09-07 -
<http://www.adobe.com/support/security/bulletins/apsb09-07.html>
* Vulnerability Note VU#568153 -
<http://www.kb.cert.org/vuls/id/568153>
____________________________________________________________________
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/techalerts/TA09-161A.html>
____________________________________________________________________
Feedback can be directed to US-CERT Technical Staff. Please send
email to <cert@cert.org> with "TA09-161A Feedback VU#568153" in
the subject.
____________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________
Produced 2009 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
____________________________________________________________________
Revision History
June 10, 2009: Initial release
This advisory contains information released by the original author. Some of the information may have changed since it was released. If the issue affects you, it may be prudent to retrieve the advisory from the site of the original source to ensure that you receive the most current information concerning that problem. Reference to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favouring by CPNI.
The views and opinions of authors expressed within this notice shall not be used for advertising or product endorsement purposes. CPNI shall not accept responsibility for any errors or omissions contained within this advisory. In particular, they shall not be liable for any loss or damage whatsoever, arising from or in connection with the usage of information contained within this advisory.
CSIRTUK is a member of the Forum of Incident Response and Security Teams (FIRST) and has contacts with other international Incident Response Teams (IRTs) in order to foster cooperation and coordination in incident prevention, to prompt rapid reaction to incidents, and to promote information sharing amongst its members and the community at large.
Fri, 12 Jun 2009 11:44:00 GMT
Domain affected: Technical