Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 on Unix, when Debug mode is enabled, allow attackers to execute arbitrary code via unspecified vectors, related to a "format bug."

Adobe Reader has been updated to fix numerous security vulnerabilities. Some of the vulnerabilities allowed attackers to potentially execute arbitrary code on the victim's system via specially crafted PDF files.

(CVE-2007-0048 / CVE-2007-0045 / CVE-2009-2564 / CVE-2009-2979 / CVE-2009-2980 / CVE-2009-2981 / CVE-2009-2982 / CVE-2009-2983 / CVE-2009-2985 / CVE-2009-2986 / CVE-2009-2988 / CVE-2009-2990 / CVE-2009-2991 / CVE-2009-2992 / CVE-2009-2993 / CVE-2009-2994 / CVE-2009-2996 / CVE-2009-2997 / CVE-2009-2998 / CVE-2009-3431 / CVE-2009-3458 / CVE-2009-3459 / CVE-2009-3462)

Adobe Reader has been updated to fix numerous security vulnerabilities. Some of the vulnerabilities allowed attackers to potentially execute arbitrary code on the victim's system via specially crafted PDF files.

(CVE-2007-0048, CVE-2007-0045, CVE-2009-2564,CVE-2009-2979, CVE-2009-2980, CVE-2009-2981, CVE-2009-2982, CVE-2009-2983, CVE-2009-2985, CVE-2009-2986, CVE-2009-2988, CVE-2009-2990, CVE-2009-2991, CVE-2009-2992, CVE-2009-2993, CVE-2009-2994, CVE-2009-2996, CVE-2009-2997, CVE-2009-2998, CVE-2009-3431, CVE-2009-3458, CVE-2009-3459, CVE-2009-3462)

The remote host is affected by the vulnerability described in GLSA-200910-03 (Adobe Reader: Multiple vulnerabilities)

    Multiple vulnerabilities were discovered in Adobe Reader. For further     information please consult the CVE entries and the Adobe Security     Bulletin referenced below.
  Impact :

    A remote attacker might entice a user to open a specially crafted PDF     file, possibly resulting in the execution of arbitrary code with the     privileges of the user running the application, Denial of Service, the     creation of arbitrary files on the victim's system, 'Trust Manager'     bypass, or social engineering attacks.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:1499 advisory.

    Adobe Reader allows users to view and print documents in Portable Document     Format (PDF).

    Multiple flaws were discovered in Adobe Reader. A specially-crafted PDF     file could cause Adobe Reader to crash or, potentially, execute arbitrary     code as the user running Adobe Reader when opened. (CVE-2009-2980,     CVE-2009-2983, CVE-2009-2985, CVE-2009-2986, CVE-2009-2990, CVE-2009-2991,     CVE-2009-2993, CVE-2009-2994, CVE-2009-2996, CVE-2009-2997, CVE-2009-2998,     CVE-2009-3458, CVE-2009-3459, CVE-2009-3462)

    Multiple flaws were discovered in Adobe Reader. A specially-crafted PDF     file could cause Adobe Reader to crash when opened. (CVE-2009-2979,     CVE-2009-2988, CVE-2009-3431)

    An input validation flaw was found in Adobe Reader. Opening a     specially-crafted PDF file could lead to a Trust Manager restrictions     bypass. (CVE-2009-2981)

    All Adobe Reader users should install these updated packages. They contain     Adobe Reader version 8.1.7, which is not vulnerable to these issues. All     running instances of Adobe Reader must be restarted for the update to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
51709	SuSE 10 Security Update : acroread_ja (ZYPP Patch Number 6585)	Nessus	SuSE Local Security Checks	high
51708	SuSE 10 Security Update : acroread_ja (ZYPP Patch Number 6584)	Nessus	SuSE Local Security Checks	high
51694	SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 6583)	Nessus	SuSE Local Security Checks	high
51693	SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 6582)	Nessus	SuSE Local Security Checks	high
42318	openSUSE 10 Security Update : acroread (acroread-6588)	Nessus	SuSE Local Security Checks	high
42251	SuSE 11 Security Update : acroread_ja (SAT Patch Number 1424)	Nessus	SuSE Local Security Checks	high
42250	SuSE 11 Security Update : Acrobat Reader (SAT Patch Number 1425)	Nessus	SuSE Local Security Checks	high
42247	openSUSE Security Update : acroread (acroread-1426)	Nessus	SuSE Local Security Checks	high
42244	openSUSE Security Update : acroread (acroread-1426)	Nessus	SuSE Local Security Checks	high
42239	GLSA-200910-03 : Adobe Reader: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
42134	RHEL 5 : acroread (RHSA-2009:1499)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2009-3462

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high