Unspecified vulnerability in the Download Manager in Adobe Reader 8.1.2 and earlier on Windows allows remote attackers to change Internet Security options on a client machine via unknown vectors.

The version of Adobe Acrobat installed on the remote host is earlier than 9.0 / 8.1.3.  Such versions are reportedly affected by multiple vulnerabilities :

  - There is a published denial of service issue.
    (CVE-2008-2549)

  - A stack-based buffer overflow when parsing format     strings containing a floating point specifier in the     'util.printf()' JavaScript function may allow an     attacker to execute arbitrary code. (CVE-2008-2992)

  - Multiple input validation errors could lead to code     execution. (CVE-2008-4812)

  - Multiple input validation issues could lead to remote     code execution. (CVE-2008-4813)

  - A heap corruption vulnerability in an AcroJS function     available to scripting code inside of a PDF document     could lead to remote code execution. (CVE-2008-4817)

  - An input validation issue in the Download Manager used     by Adobe Acrobat could lead to remote code execution     during the download process. (CVE-2008-5364)

  - An issue in the Download Manager used by Adobe Acrobat     could lead to a user's Internet Security options being     changed during the download process. (CVE-2008-4816)

  - An input validation issue in a JavaScript method could     lead to remote code execution. (CVE-2008-4814)

The acroread package was update to fix several security vulnerabilities in the JavaScript engine. (CVE-2008-2992, CVE-2008-2549, CVE-2008-4812, CVE-2008-4813, CVE-2008-4817, CVE-2008-4816, CVE-2008-4814, CVE-2008-4815)

The acroread package was update to fix several security vulnerabilities in the JavaScript engine. (CVE-2008-2992 / CVE-2008-2549 / CVE-2008-4812 / CVE-2008-4813 / CVE-2008-4817 / CVE-2008-4816 / CVE-2008-4814 / CVE-2008-4815)

The version of Adobe Reader installed on the remote host is earlier than 8.1.3.  Such versions are reportedly affected by multiple vulnerabilities :

  - There is a publicly-published denial of service issue     (CVE-2008-2549).

  - A stack-based buffer overflow when parsing format     strings containing a floating point specifier in the     'util.printf()' JavaScript function may allow an     attacker to execute arbitrary code (CVE-2008-2992).

  - Multiple input validation errors could lead to code     execution (CVE-2008-4812).

  - Multiple input validation issues could lead to remote     code execution. (CVE-2008-4813)

  - A heap corruption vulnerability in an AcroJS function     available to scripting code inside of a PDF document     could lead to remote code execution. (CVE-2008-4817)

  - An input validation issue in the Download Manager used     by Adobe Reader could lead to remote code execution     during the download process (CVE-2008-5364).

  - An issue in the Download Manager used by Adobe Reader     could lead to a user's Internet Security options being     changed during the download process (CVE-2008-4816).

  - An input validation issue in a JavaScript method could     lead to remote code execution (CVE-2008-4814).

ID	Name	Product	Family	Severity
40802	Adobe Acrobat < 8.1.3 Multiple Vulnerabilities	Nessus	Windows	high
39905	openSUSE Security Update : acroread (acroread-295)	Nessus	SuSE Local Security Checks	high
34943	openSUSE 10 Security Update : acroread (acroread-5749)	Nessus	SuSE Local Security Checks	high
34942	SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 5746)	Nessus	SuSE Local Security Checks	high
34695	Adobe Reader < 8.1.3 / 9.0 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2008-4816

critical

Tenable Plugins

high

high

high

high

high