The EScript.api plugin in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.1, and 8.x before 8.2.6 on Windows and Mac OS X allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document that triggers memory corruption, involving the printSeps function. NOTE: some of these details are obtained from third party information.

Specially crafted PDF documents could crash acroread or lead to execution of arbitrary code. acroread was updated to version 9.4.2 to address the issues.

(CVE-2010-4091, CVE-2011-0562, CVE-2011-0563, CVE-2011-0565, CVE-2011-0566, CVE-2011-0567, CVE-2011-0570, CVE-2011-0585, CVE-2011-0586, CVE-2011-0587, CVE-2011-0588, CVE-2011-0589, CVE-2011-0590, CVE-2011-0591, CVE-2011-0592, CVE-2011-0593, CVE-2011-0594, CVE-2011-0595, CVE-2011-0596, CVE-2011-0598, CVE-2011-0599, CVE-2011-0600, CVE-2011-0602, CVE-2011-0603, CVE-2011-0604, CVE-2011-0606, CVE-2011-0558, CVE-2011-0559, CVE-2011-0560, CVE-2011-0561, CVE-2011-0571, CVE-2011-0572, CVE-2011-0573, CVE-2011-0574, CVE-2011-0575, CVE-2011-0577, CVE-2011-0578, CVE-2011-0607, CVE-2011-0608)

This update of acroread fixes two critical vulnerabilities. The first one in referenced by CVE-2010-3654 and exists in the integrated authplay component that may allow remote attackers to take control over a victims system. (CVE-2010-3654: CVSS v2 Base Score: 6.8 (critical) (AV:N/AC:M/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)) The other issue was disclosed on full-disclosure to demonstrate a denial of service attack, an extend of this attack to execute arbitrary code could be possible. (CVE-2010-4091: CVSS v2 Base Score: 6.8 (critical) (AV:N/AC:M/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119))

The remote host is affected by the vulnerability described in GLSA-201201-19 (Adobe Reader: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Adobe Reader. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted PDF       file using Adobe Reader, possibly resulting in the remote execution of       arbitrary code, a Denial of Service, or other impact.
  Workaround :

    There is no known workaround at this time.

Specially crafted PDF documents can crash acroread or lead to execution of arbitrary code. Acroread has been updated to version 9.4.2 to address the issues (CVE-2010-4091 / CVE-2011-0562 / CVE-2011-0563 / CVE-2011-0565 / CVE-2011-0566 / CVE-2011-0567 / CVE-2011-0570 / CVE-2011-0585 / CVE-2011-0586 / CVE-2011-0587 / CVE-2011-0588 / CVE-2011-0589 / CVE-2011-0590 / CVE-2011-0591 / CVE-2011-0592 / CVE-2011-0593 / CVE-2011-0594 / CVE-2011-0595 / CVE-2011-0596 / CVE-2011-0598 / CVE-2011-0599 / CVE-2011-0600 / CVE-2011-0602 / CVE-2011-0603 / CVE-2011-0604 / CVE-2011-0606 / CVE-2011-0558 / CVE-2011-0559 / CVE-2011-0560 / CVE-2011-0561 / CVE-2011-0571 / CVE-2011-0572 / CVE-2011-0573 / CVE-2011-0574 / CVE-2011-0575 / CVE-2011-0577 / CVE-2011-0578 / CVE-2011-0607 / CVE-2011-0608.)

Specially crafted PDF documents can crash acroread or lead to execution of arbitrary code. Acroread has been updated to version 9.4.2 to address the issues (CVE-2010-4091 / CVE-2011-0562 / CVE-2011-0563 / CVE-2011-0565 / CVE-2011-0566 / CVE-2011-0567 / CVE-2011-0570 / CVE-2011-0585 / CVE-2011-0586 / CVE-2011-0587 / CVE-2011-0588 / CVE-2011-0589 / CVE-2011-0590 / CVE-2011-0591 / CVE-2011-0592 / CVE-2011-0593 / CVE-2011-0594 / CVE-2011-0595 / CVE-2011-0596 / CVE-2011-0598 / CVE-2011-0599 / CVE-2011-0600 / CVE-2011-0602 / CVE-2011-0603 / CVE-2011-0604 / CVE-2011-0606 / CVE-2011-0558 / CVE-2011-0559 / CVE-2011-0560 / CVE-2011-0561 / CVE-2011-0571 / CVE-2011-0572 / CVE-2011-0573 / CVE-2011-0574 / CVE-2011-0575 / CVE-2011-0577 / CVE-2011-0578 / CVE-2011-0607 / CVE-2011-0608)

The version of Adobe Reader installed on the remote host is earlier than 10.0.1 / 9.4.2 / 8.2.6.  Such versions are reportedly affected by multiple vulnerabilities :

  - Multiple input validation vulnerability exist that could     lead to code execution. (CVE-2010-4091, CVE-2011-0586,     CVE-2011-0587, CVE-2011-0604)     
  - Multiple library loading vulnerabilities exist that     could lead to code execution. (CVE-2011-0562,     CVE-2011-0570, CVE-2011-0575, CVE-2011-0588)     
  - Multiple memory corruption vulnerabilities exist that     could lead to code execution. (CVE-2011-0563,     CVE-2011-0559, CVE-2011-0560, CVE-2011-0561,     CVE-2011-0571, CVE-2011-0572, CVE-2011-0573,     CVE-2011-0574, CVE-2011-0578, CVE-2011-0589,     CVE-2011-0606, CVE-2011-0607, CVE-2011-0608)     
  - A Windows-only file permissions issue exists that could     lead to privilege escalation. (CVE-2011-0564)     
  - An unspecified vulnerability exists that could cause the     application to crash or potentially lead to code     execution. (CVE-2011-0565)     
  - Multiple image-parsing memory corruption vulnerabilities     exist that could lead to code execution. (CVE-2011-0566,     CVE-2011-0567, CVE-2011-0596, CVE-2011-0598,     CVE-2011-0599, CVE-2011-0602, CVE-2011-0603)

  - An unspecified vulnerability exists that could cause the     application to crash or potentially lead to code     execution. (CVE-2011-0585)

  - Multiple 3D file parsing input validation     vulnerabilities exist that could lead to code execution.
    (CVE-2011-0590, CVE-2011-0591, CVE-2011-0592,      CVE-2011-0593, CVE-2011-0595, CVE-2011-0600)   
  - Multiple font parsing input validation vulnerabilities     exist that could lead to code execution. (CVE-2011-0594,     CVE-2011-0577)

  - An integer overflow vulnerability exists that could lead     to code execution. (CVE-2011-0558)

The version of Adobe Acrobat installed on the remote host is earlier than 10.0.1 / 9.4.2 / 8.2.5.  Such versions are reportedly affected by multiple vulnerabilities :

  - Multiple input validation vulnerability exist that could     lead to code execution. (CVE-2010-4091, CVE-2011-0586,     CVE-2011-0587, CVE-2011-0604)     
  - Multiple library loading vulnerabilities exist that     could lead to code execution. (CVE-2011-0562,     CVE-2011-0570, CVE-2011-0575, CVE-2011-0588)     
  - Multiple memory corruption vulnerabilities exist that     could lead to code execution. (CVE-2011-0563,     CVE-2011-0559, CVE-2011-0560, CVE-2011-0561,     CVE-2011-0571, CVE-2011-0572, CVE-2011-0573,     CVE-2011-0574, CVE-2011-0578, CVE-2011-0589,     CVE-2011-0606, CVE-2011-0607, CVE-2011-0608)     
  - A Windows-only file permissions issue exists that could     lead to privilege escalation. (CVE-2011-0564)     
  - An unspecified vulnerability exists that could cause the     application to crash or potentially lead to code     execution. (CVE-2011-0565)     
  - Multiple image-parsing memory corruption vulnerabilities     exist that could lead to code execution. (CVE-2011-0566,     CVE-2011-0567, CVE-2011-0596, CVE-2011-0598,     CVE-2011-0599, CVE-2011-0602, CVE-2011-0603)

  - An unspecified vulnerability exists that could cause the     application to crash or potentially lead to code     execution. (CVE-2011-0585)

  - Multiple 3D file parsing input validation     vulnerabilities exist that could lead to code execution.
    (CVE-2011-0590, CVE-2011-0591, CVE-2011-0592,      CVE-2011-0593, CVE-2011-0595, CVE-2011-0600)   
  - Multiple font parsing input validation vulnerabilities     exist that could lead to code execution. (CVE-2011-0594,     CVE-2011-0577)

  - An integer overflow vulnerability exists that could lead     to code execution. (CVE-2011-0558)

This update of acroread fixes two critical vulnerabilities. The first one in referenced by CVE-2010-3654 and exists in the integrated authplay component that may allow remote attackers to take control over a victims system.

(CVE-2010-3654: CVSS v2 Base Score: 6.8 (critical) (AV:N/AC:M/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119))

The other issue was disclosed on full-disclosure to demonstrate a denial of service attack, an extend of this attack to execute arbitrary code could be possible.

(CVE-2010-4091: CVSS v2 Base Score: 6.8 (critical) (AV:N/AC:M/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119))

The remote host is affected by the vulnerability described in GLSA-201101-08 (Adobe Reader: Multiple vulnerabilities)

    Multiple vulnerabilities were discovered in Adobe Reader. For further     information please consult the CVE entries and the Adobe Security     Bulletins referenced below.
  Impact :

    A remote attacker might entice a user to open a specially crafted PDF     file, possibly resulting in the execution of arbitrary code with the     privileges of the user running the application, or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0934 advisory.

    Adobe Reader allows users to view and print documents in Portable Document     Format (PDF).

    This update fixes two vulnerabilities in Adobe Reader. These     vulnerabilities are detailed on the Adobe security page APSB10-28, listed     in the References section. A specially-crafted PDF file could cause Adobe     Reader to crash or, potentially, execute arbitrary code as the user running     Adobe Reader when opened. (CVE-2010-3654, CVE-2010-4091)

    All Adobe Reader users should install these updated packages. They contain     Adobe Reader version 9.4.1, which is not vulnerable to these issues. All     running instances of Adobe Reader must be restarted for the update to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Reader installed on the remote host is earlier than 9.4.1.  Such versions are reportedly affected by multiple vulnerabilities :

  - A memory corruption vulnerability exists that could lead     to code execution.  Note that this issue does not affect     Adobe Reader 8.x.  (CVE-2010-3654)

  - An input validation issue exists that could lead to a     bypass of cross-domain policy file restrictions with     certain server encodings. (CVE-2010-3636)

  - A memory corruption vulnerability exists in the ActiveX     component. (CVE-2010-3637)

  - An unspecified issue exists which could lead to a     denial of service or potentially arbitrary code     execution. (CVE-2010-3639)

  - Multiple memory corruption issues exist that could lead     to arbitrary code execution. (CVE-2010-3640,     CVE-2010-3641, CVE-2010-3642, CVE-2010-3643,     CVE-2010-3644, CVE-2010-3645, CVE-2010-3646,     CVE-2010-3647, CVE-2010-3648, CVE-2010-3649,     CVE-2010-3650, CVE-2010-3652)     
  - A library-loading vulnerability could lead to code     execution. (CVE-2010-3976)

  - A memory corruption vulnerability exists that could lead     to code execution. (CVE-2010-4091)

ID	Name	Product	Family	Severity
75421	openSUSE Security Update : acroread (openSUSE-SU-2011:0156-1)	Nessus	SuSE Local Security Checks	high
75420	openSUSE Security Update : acroread (openSUSE-SU-2010:1030-1)	Nessus	SuSE Local Security Checks	high
57745	GLSA-201201-19 : Adobe Reader: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
53693	openSUSE Security Update : acroread (openSUSE-SU-2011:0156-1)	Nessus	SuSE Local Security Checks	high
53692	openSUSE Security Update : acroread (openSUSE-SU-2010:1030-1)	Nessus	SuSE Local Security Checks	high
53651	openSUSE Security Update : acroread (openSUSE-SU-2010:1030-1)	Nessus	SuSE Local Security Checks	high
52568	SuSE 10 Security Update : acroread_ja (ZYPP Patch Number 7359)	Nessus	SuSE Local Security Checks	high
52567	SuSE 10 Security Update : acroread (ZYPP Patch Number 7358)	Nessus	SuSE Local Security Checks	high
52566	SuSE 11.1 Security Update : acroread_ja (SAT Patch Number 4058)	Nessus	SuSE Local Security Checks	high
52565	SuSE 11.1 Security Update : acroread (SAT Patch Number 4057)	Nessus	SuSE Local Security Checks	high
51925	Adobe Reader < 10.0.1 / 9.4.2 / 8.2.6 Multiple Vulnerabilities (APSB11-03)	Nessus	Windows	high
51924	Adobe Acrobat < 10.0.1 / 9.4.2 / 8.2.5 Multiple Vulnerabilities (APSB11-03)	Nessus	Windows	high
51716	SuSE 10 Security Update : acroread_ja (ZYPP Patch Number 7267)	Nessus	SuSE Local Security Checks	high
51704	SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 7266)	Nessus	SuSE Local Security Checks	high
51657	GLSA-201101-08 : Adobe Reader: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
51087	SuSE 11 / 11.1 Security Update : acroread_ja (SAT Patch Numbers 3638 / 3639)	Nessus	SuSE Local Security Checks	high
51086	SuSE 11 / 11.1 Security Update : Acrobat Reader (SAT Patch Numbers 3634 / 3636)	Nessus	SuSE Local Security Checks	high
50869	RHEL 5 / 6 : acroread (RHSA-2010:0934)	Nessus	Red Hat Local Security Checks	critical
50614	Adobe Reader < 9.4.1 Multiple Vulnerabilities (APSB10-28)	Nessus	Windows	high

Detections

Analytics

CVE-2010-4091

critical

Tenable Plugins

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high