Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.

SunOS 5.10: Adobe Acrobat Reader patch.
Date this patch was last updated by Sun : Nov/27/09

Updated acroread packages that fix several security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

[Updated 23 Jan 2007] The previous acroread packages were missing dependencies on the new libraries which could prevent acroread from starting. Replacement acroread packages have been added to this erratum to correct this issue.

The Adobe Reader allows users to view and print documents in portable document format (PDF).

A cross site scripting flaw was found in the way the Adobe Reader Plugin processes certain malformed URLs. A malicious web page could inject arbitrary javascript into the browser session which could possibly lead to a cross site scripting attack. (CVE-2007-0045)

Two arbitrary code execution flaws were found in the way Adobe Reader processes malformed document files. It may be possible to execute arbitrary code on a victim's machine if the victim opens a malicious PDF file. (CVE-2006-5857, CVE-2007-0046)

Please note that Adobe Reader 7.0.9 requires versions of several system libraries that were not shipped with Red Hat Enterprise Linux 3. This update contains additional packages that provide the required system library versions for Adobe Reader. These additional packages are only required by Adobe Reader and do not replace or affect any other aspects of a Red Hat Enterprise Linux 3 system.

All users of Adobe Reader are advised to upgrade to these updated packages, which contain Adobe Reader version 7.0.9 and additional libraries to correct these issues.

Updated acroread packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Adobe Acrobat Reader allows users to view and print documents in portable document format (PDF).

A cross site scripting flaw was found in the way the Adobe Reader Plugin processes certain malformed URLs. A malicious web page could inject arbitrary javascript into the browser session which could possibly lead to a cross site scripting attack. (CVE-2007-0045)

Two arbitrary code execution flaws were found in the way Adobe Reader processes malformed document files. It may be possible to execute arbitrary code on a victim's machine if the victim opens a malicious PDF file. (CVE-2006-5857, CVE-2007-0046)

All users of Acrobat Reader are advised to upgrade to these updated packages, which contain Acrobat Reader version 7.0.9 and are not vulnerable to these issues.

The Adobe Acrobat Reader has been updated to version 7.0.9.

For SUSE Linux Enterprise Server 9 this version now includes its own GLIB2, ATK, PANGO and GTK2 libraries, since Acroread 7.0.x requires a minimum level of GTK2 2.4.

This update also includes following security fixes :

  - A memory corruption problem was fixed in Adobe Acrobat     Reader can potentially lead to code execution.
    (CVE-2006-5857)

  - Universal cross-site request forgery (CSRF) problems     were fixed in the Acrobat Reader plugin which could be     exploited by remote attackers to conduct CSRF attacks     using any site that is providing PDFs. (CVE-2007-0044)

  - Cross-site scripting problems in the Acrobat Reader     plugin were fixed, which could be exploited by remote     attackers to conduct XSS attacks against any site that     is providing PDFs. (CVE-2007-0045)

  - A double free problem in the Acrobat Reader plugin was     fixed which could be used by remote attackers to     potentially execute arbitrary code. Note that all     platforms using Adobe Reader currently have counter     measures against such attack where it will just cause a     controlled abort(). (CVE-2007-0046)

  - CVE-2007-0047 and CVE-2007-0048 affect only Microsoft     Windows and Internet Explorer.

The version of Adobe Acrobat installed on the remote host is earlier than 6.0.6 / 7.0.9 / 8.0 and thus reportedly is affected by several security issues, including one that can lead to arbitrary code execution when processing a malicious PDF file.

The Adobe Acrobat Reader (Japanese version) has been updated to version 7.0.9.

This update also includes following security fixes :

  - A memory corruption problem was fixed in Adobe Acrobat     Reader can potentially lead to code execution.
    (CVE-2006-5857)

  - Universal cross-site request forgery (CSRF) problems     were fixed in the Acrobat Reader plugin which could be     exploited by remote attackers to conduct CSRF attacks     using any site that is providing PDFs. (CVE-2007-0044)

  - Cross-site scripting problems in the Acrobat Reader     plugin were fixed, which could be exploited by remote     attackers to conduct XSS attacks against any site that     is providing PDFs. (CVE-2007-0045)

  - A double free problem in the Acrobat Reader plugin was     fixed which could be used by remote attackers to     potentially execute arbitrary code. Note that all     platforms using Adobe Reader currently have counter     measures against such attack where it will just cause a     controlled abort(). (CVE-2007-0046)

The Adobe Acrobat Reader has been updated to version 7.0.9.

This update also includes following security fixes :

  - A memory corruption problem was fixed in Adobe Acrobat     Reader can potentially lead to code execution.
    (CVE-2006-5857)

  - Universal cross-site request forgery (CSRF) problems     were fixed in the Acrobat Reader plugin which could be     exploited by remote attackers to conduct CSRF attacks     using any site that is providing PDFs. (CVE-2007-0044)

  - Cross-site scripting problems in the Acrobat Reader     plugin were fixed, which could be exploited by remote     attackers to conduct XSS attacks against any site that     is providing PDFs. (CVE-2007-0045)

  - A double free problem in the Acrobat Reader plugin was     fixed which could be used by remote attackers to     potentially execute arbitrary code. Note that all     platforms using Adobe Reader currently have counter     measures against such attack where it will just cause a     controlled abort(). (CVE-2007-0046)

The Adobe Acrobat Reader has been updated to version 7.0.9.

This update also includes following security fixes :

CVE-2006-5857: A memory corruption problem was fixed in Adobe Acrobat Reader can potentially lead to code execution.

CVE-2007-0044: Universal Cross Site Request Forgery (CSRF) problems were fixed in the Acrobat Reader plugin which could be exploited by remote attackers to conduct CSRF attacks using any site that is providing PDFs.

CVE-2007-0045: Cross site scripting problems in the Acrobat Reader plugin were fixed, which could be exploited by remote attackers to conduct XSS attacks against any site that is providing PDFs.

CVE-2007-0046: A double free problem in the Acrobat Reader plugin was fixed which could be used by remote attackers to potentially execute arbitrary code. Note that all platforms using Adobe Reader currently have counter measures against such attack where it will just cause a controlled abort().

CVE-2007-0047 and CVE-2007-0048 affect only Microsoft Windows and Internet Explorer.

The remote host is affected by the vulnerability described in GLSA-200701-16 (Adobe Acrobat Reader: Multiple vulnerabilities)

    Adobe Acrobat Reader in stand-alone mode is vulnerable to remote code     execution via heap corruption when loading a specially crafted PDF     file.
    The browser plugin released with Adobe Acrobat Reader (nppdf.so) does     not properly handle URLs, and crashes if given a URL that is too long.
    The plugin does not correctly handle JavaScript, and executes     JavaScript that is given as a GET variable to the URL of a PDF file.
    Lastly, the plugin does not properly handle the FDF, xml, xfdf AJAX     request parameters following the # character in a URL, allowing for     multiple cross-site scripting vulnerabilities.
  Impact :

    An attacker could entice a user to open a specially crafted PDF file     and execute arbitrary code with the rights of the user running Adobe     Acrobat Reader. An attacker could also entice a user to browse to a     specially crafted URL and either crash the Adobe Acrobat Reader browser     plugin, execute arbitrary JavaScript in the context of the user's     browser, or inject arbitrary HTML or JavaScript into the document being     viewed by the user. Note that users who have emerged Adobe Acrobat     Reader with the 'nsplugin' USE flag disabled are not vulnerable to     issues with the Adobe Acrobat Reader browser plugin.
  Workaround :

    There is no known workaround at this time.

The version of Adobe Reader installed on the remote host is earlier than 7.0.9 / 8.0 and is, therefore, reportedly affected by several security issues, including one that can lead to arbitrary code execution when processing a malicious PDF file.

The version of Adobe PDF Plug-In installed on the remote host is earlier than 8.0 / 7.0.9 / 6.0.6 and reportedly fails to properly sanitize input to the 'FDF', 'XML', or 'XFDF' fields used by its 'Open Parameters' feature. By tricking a user into accessing a specially crafted link and depending on the browser with which the plugin is used, a remote attacker may be able to leverage these issues to conduct arbitrary code execution, denial of service, cross-site script forgery, or cross-site scripting attacks against a user on the remote host.

ID	Name	Product	Family	Severity
107373	Solaris 10 (sparc) : 121104-11	Nessus	Solaris Local Security Checks	high
63836	RHEL 3 : Adobe Acrobat Reader (RHSA-2007:0021)	Nessus	Red Hat Local Security Checks	high
63835	RHEL 4 : Adobe Acrobat Reader (RHSA-2007:0017)	Nessus	Red Hat Local Security Checks	high
41117	SuSE9 Security Update : acroread (YOU Patch Number 11433)	Nessus	SuSE Local Security Checks	high
40798	Adobe Acrobat < 6.0.6 / 7.0.9 Multiple Vulnerabilities	Nessus	Windows	high
29371	SuSE 10 Security Update : acroread_ja (ZYPP Patch Number 2545)	Nessus	SuSE Local Security Checks	high
29370	SuSE 10 Security Update : acroread (ZYPP Patch Number 2508)	Nessus	SuSE Local Security Checks	high
27144	openSUSE 10 Security Update : acroread (acroread-2506)	Nessus	SuSE Local Security Checks	high
24252	GLSA-200701-16 : Adobe Acrobat Reader: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
24002	Adobe Reader < 6.0.6 / 7.0.9 Multiple Vulnerabilities	Nessus	Windows	high
23975	Adobe PDF Plug-In < 8.0 / 7.0.9 / 6.0.6 Multiple Vulnerabilities (APSB07-01)	Nessus	Windows	high

Detections

Analytics

CVE-2007-0046

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high