Detections
Analytics
Adobe Acrobat < 8.1.3 Multiple Vulnerabilities
high Nessus Plugin ID 40802
Language:
Synopsis
The version of Adobe Acrobat on the remote Windows host is affected by multiple vulnerabilities.Description
The version of Adobe Acrobat installed on the remote host is earlier than 9.0 / 8.1.3. Such versions are reportedly affected by multiple vulnerabilities :- There is a published denial of service issue.
(CVE-2008-2549)
- A stack-based buffer overflow when parsing format strings containing a floating point specifier in the 'util.printf()' JavaScript function may allow an attacker to execute arbitrary code. (CVE-2008-2992)
- Multiple input validation errors could lead to code execution. (CVE-2008-4812)
- Multiple input validation issues could lead to remote code execution. (CVE-2008-4813)
- A heap corruption vulnerability in an AcroJS function available to scripting code inside of a PDF document could lead to remote code execution. (CVE-2008-4817)
- An input validation issue in the Download Manager used by Adobe Acrobat could lead to remote code execution during the download process. (CVE-2008-5364)
- An issue in the Download Manager used by Adobe Acrobat could lead to a user's Internet Security options being changed during the download process. (CVE-2008-4816)
- An input validation issue in a JavaScript method could lead to remote code execution. (CVE-2008-4814)
Solution
Upgrade to Adobe Acrobat 9.0 / 8.1.3 or later.See Also
https://www.adobe.com/support/security/bulletins/apsb08-19.html
Plugin Details
Severity: High
ID: 40802
File Name: adobe_acrobat_813.nasl
Version: 1.18
Type: local
Agent: windows
Family: Windows
Published: 8/28/2009
Updated: 5/31/2024
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.6
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 8.1
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2008-5364
Vulnerability Information
CPE: cpe:/a:adobe:acrobat
Required KB Items: installed_sw/Adobe Acrobat
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/4/2008
Vulnerability Publication Date: 5/29/2008
CISA Known Exploited Vulnerability Due Dates: 3/24/2022
Exploitable With
CANVAS (CANVAS)
Core Impact
Metasploit (Adobe util.printf() Buffer Overflow)
Reference Information
CVE: CVE-2008-2549, CVE-2008-2992, CVE-2008-4812, CVE-2008-4813, CVE-2008-4814, CVE-2008-4816, CVE-2008-4817, CVE-2008-5364