Detections
Analytics
Adobe Reader < 8.1.3 / 9.0 Multiple Vulnerabilities
high Nessus Plugin ID 34695
Language:
Synopsis
The PDF file viewer on the remote Windows host is affected by multiple vulnerabilities.Description
The version of Adobe Reader installed on the remote host is earlier than 8.1.3. Such versions are reportedly affected by multiple vulnerabilities :- There is a publicly-published denial of service issue (CVE-2008-2549).
- A stack-based buffer overflow when parsing format strings containing a floating point specifier in the 'util.printf()' JavaScript function may allow an attacker to execute arbitrary code (CVE-2008-2992).
- Multiple input validation errors could lead to code execution (CVE-2008-4812).
- Multiple input validation issues could lead to remote code execution. (CVE-2008-4813)
- A heap corruption vulnerability in an AcroJS function available to scripting code inside of a PDF document could lead to remote code execution. (CVE-2008-4817)
- An input validation issue in the Download Manager used by Adobe Reader could lead to remote code execution during the download process (CVE-2008-5364).
- An issue in the Download Manager used by Adobe Reader could lead to a user's Internet Security options being changed during the download process (CVE-2008-4816).
- An input validation issue in a JavaScript method could lead to remote code execution (CVE-2008-4814).
Solution
Upgrade to Adobe Reader 9.0 / 8.1.3 or later.See Also
https://secuniaresearch.flexerasoftware.com/secunia_research/2008-14/
https://www.secureauth.com/labs/advisories/adobe-reader-buffer-overflow
http://www.nessus.org/u?4d149b32
http://www.nessus.org/u?b4f90b46
http://www.nessus.org/u?f6f3b943
https://www.zerodayinitiative.com/advisories/ZDI-08-072/
https://www.zerodayinitiative.com/advisories/ZDI-08-073/
https://www.zerodayinitiative.com/advisories/ZDI-08-074/
https://www.securityfocus.com/archive/1/498027/30/0/threaded
https://www.securityfocus.com/archive/1/498032/30/0/threaded
https://www.adobe.com/support/security/bulletins/apsb08-19.html
Plugin Details
Severity: High
ID: 34695
File Name: adobe_reader_813.nasl
Version: 1.31
Type: local
Agent: windows
Family: Windows
Published: 11/4/2008
Updated: 3/8/2022
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.6
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 8.1
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2008-5364
Vulnerability Information
CPE: cpe:/a:adobe:acrobat_reader
Required KB Items: SMB/Acroread/Version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/4/2008
CISA Known Exploited Vulnerability Due Dates: 3/24/2022
Exploitable With
CANVAS (CANVAS)
Core Impact
Metasploit (Adobe util.printf() Buffer Overflow)
Reference Information
CVE: CVE-2008-2549, CVE-2008-2992, CVE-2008-4812, CVE-2008-4813, CVE-2008-4814, CVE-2008-4816, CVE-2008-4817, CVE-2008-5364