Detections
Analytics
Adobe Reader < 7.1.0 / 8.1.2 Multiple Vulnerabilities
high Nessus Plugin ID 30200
Synopsis
The PDF file viewer on the remote Windows host is affected by multiple vulnerabilities.Description
The version of Adobe Reader installed on the remote host is earlier than 8.1.2 or 7.1.0. Such versions are reportedly affected by multiple vulnerabilities :- A design error vulnerability may allow an attacker to gain control of a user's printer.
- Multiple stack-based buffer overflows may allow an attacker to execute arbitrary code subject to the user's privileges.
- Insecure loading of 'Security Provider' libraries may allow for arbitrary code execution.
- An insecure method exposed by the JavaScript library in the 'EScript.api' plug-in allows direct control over low-level features of the object, which allows for execution of arbitrary code as the current user.
- Two vulnerabilities in the unpublicized function 'app.checkForUpdate()' exploited through a callback function could lead to arbitrary code execution in Adobe Reader 7.
Solution
Upgrade to Adobe Reader 8.1.2 / 7.1.0 or later.See Also
http://www.nessus.org/u?8619fcdc
http://www.nessus.org/u?1d74fcf2
http://www.nessus.org/u?4c30fbc0
https://www.zerodayinitiative.com/advisories/ZDI-08-004/
https://seclists.org/bugtraq/2008/Feb/79
https://seclists.org/bugtraq/2008/Feb/103
https://seclists.org/bugtraq/2008/Feb/104
https://seclists.org/bugtraq/2008/Feb/105
https://seclists.org/bugtraq/2008/Feb/146
https://seclists.org/fulldisclosure/2008/May/140
https://seclists.org/fulldisclosure/2008/May/141
https://helpx.adobe.com/acrobat/release-note/reader-acrobat-8-1-2.html
https://www.adobe.com/support/security/advisories/apsa08-01.html
https://www.adobe.com/support/security/bulletins/apsb08-13.html
Plugin Details
Severity: High
ID: 30200
File Name: adobe_reader_812.nasl
Version: 1.37
Type: local
Agent: windows
Family: Windows
Published: 2/6/2008
Updated: 6/8/2022
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.6
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 8.1
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2008-2042
Vulnerability Information
CPE: cpe:/a:adobe:acrobat_reader
Required KB Items: SMB/Acroread/Version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 2/7/2008
CISA Known Exploited Vulnerability Due Dates: 6/22/2022
Exploitable With
CANVAS (CANVAS)
Core Impact
Metasploit (Adobe Collab.collectEmailInfo() Buffer Overflow)
Reference Information
CVE: CVE-2007-5659, CVE-2007-5663, CVE-2007-5666, CVE-2008-0655, CVE-2008-0667, CVE-2008-0726, CVE-2008-2042
BID: 27641