Untrusted search path vulnerability in Adobe Reader and Acrobat 8.1.2 and earlier on Unix and Linux allows attackers to gain privileges via a Trojan Horse program in an unspecified directory that is associated with an insecure RPATH.

Updated acroread packages that fix various security issues are now available for Red Hat Enterprise Linux 3 Extras, Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Adobe Reader allows users to view and print documents in Portable Document Format (PDF).

Several input validation flaws were discovered in Adobe Reader. A malicious PDF file could cause Adobe Reader to crash or, potentially, execute arbitrary code as the user running Adobe Reader.
(CVE-2008-2549, CVE-2008-2992, CVE-2008-4812, CVE-2008-4813, CVE-2008-4814, CVE-2008-4817)

The Adobe Reader binary had an insecure relative RPATH (runtime library search path) set in the ELF (Executable and Linking Format) header. A local attacker able to convince another user to run Adobe Reader in an attacker-controlled directory could run arbitrary code with the privileges of the victim. (CVE-2008-4815)

All acroread users are advised to upgrade to these updated packages, that contain Adobe Reader version 8.1.3, and are not vulnerable to these issues.

The acroread package was update to fix several security vulnerabilities in the JavaScript engine. (CVE-2008-2992, CVE-2008-2549, CVE-2008-4812, CVE-2008-4813, CVE-2008-4817, CVE-2008-4816, CVE-2008-4814, CVE-2008-4815)

The remote host is affected by the vulnerability described in GLSA-200901-09 (Adobe Reader: User-assisted execution of arbitrary code)

    An unspecified vulnerability can be triggered by a malformed PDF     document, as demonstrated by 2008-HI2.pdf (CVE-2008-2549).
    Peter Vreugdenhil, Dyon Balding, Will Dormann, Damian Frizza, and Greg     MacManus reported a stack-based buffer overflow in the util.printf     JavaScript function that incorrectly handles the format string argument     (CVE-2008-2992).
    Greg MacManus of iDefense Labs reported an array index error that can     be leveraged for an out-of-bounds write, related to parsing of Type 1     fonts (CVE-2008-4812).
    Javier Vicente Vallejo and Peter Vregdenhil, via Zero Day Initiative,     reported multiple unspecified memory corruption vulnerabilities     (CVE-2008-4813).
    Thomas Garnier of SkyRecon Systems reported an unspecified     vulnerability in a JavaScript method, related to an 'input validation     issue' (CVE-2008-4814).
    Josh Bressers of Red Hat reported an untrusted search path     vulnerability (CVE-2008-4815).
    Peter Vreugdenhil reported through iDefense that the Download Manager     can trigger a heap corruption via calls to the AcroJS function     (CVE-2008-4817).
  Impact :

    A remote attacker could entice a user to open a specially crafted PDF     document, and local attackers could entice a user to run acroread from     an untrusted working directory. Both might result in the execution of     arbitrary code with the privileges of the user running the application,     or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The acroread package was update to fix several security vulnerabilities in the JavaScript engine. (CVE-2008-2992 / CVE-2008-2549 / CVE-2008-4812 / CVE-2008-4813 / CVE-2008-4817 / CVE-2008-4816 / CVE-2008-4814 / CVE-2008-4815)

ID	Name	Product	Family	Severity
40730	RHEL 3 / 4 / 5 : acroread (RHSA-2008:0974)	Nessus	Red Hat Local Security Checks	high
39905	openSUSE Security Update : acroread (acroread-295)	Nessus	SuSE Local Security Checks	high
35367	GLSA-200901-09 : Adobe Reader: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
34943	openSUSE 10 Security Update : acroread (acroread-5749)	Nessus	SuSE Local Security Checks	high
34942	SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 5746)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2008-4815

high

Tenable Plugins

high

high

high

high

high