Detections
Analytics
Adobe Reader < 9.2 / 8.1.7 / 7.1.4 Multiple Vulnerabilities (APSB09-15)
high Nessus Plugin ID 42120
Synopsis
The PDF file viewer on the remote Windows host is affected by a memory corruption vulnerability.Description
The version of Adobe Reader installed on the remote host is earlier than 9.2 / 8.1.7 / 7.1.4. Such versions are potentially affected by multiple vulnerabilities :- A heap overflow vulnerability. (CVE-2009-3459)
- A memory corruption issue. (CVE-2009-2985)
- Multiple heap overflow vulnerabilities. (CVE-2009-2986)
- An invalid array index issue that could lead to code execution. (CVE-2009-2990)
- Multiple input validation vulnerabilities that could lead to code execution. (CVE-2009-2993)
- A buffer overflow issue. (CVE-2009-2994)
- A heap overflow vulnerability. (CVE-2009-2997)
- An input validation issue that could lead to code execution. (CVE-2009-2998)
- An input validation issue that could lead to code execution. (CVE-2009-3458)
- A memory corruption issue that leads to a denial of service. (CVE-2009-2983)
- An integer overflow that leads to a denial of service.
(CVE-2009-2980)
- A memory corruption issue that leads to a denial of service. (CVE-2009-2996)
- An input validation issue that could lead to a bypass of Trust Manager restrictions. (CVE-2009-2981)
- A certificate is used that, if compromised, could be used in a social engineering attack. (CVE-2009-2982)
- A stack overflow issue that could lead to a denial of service. (CVE-2009-3431)
- A XMP-XML entity expansion issue that could lead to a denial of service attack. (CVE-2009-2979)
- A remote denial of service issue in the ActiveX control.
(CVE-2009-2987)
- An input validation issue. (CVE-2009-2988)
- An input validation issue specific to the ActiveX control. (CVE-2009-2992)
- A third-party web download product is used that could lead to a local privilege escalation. (CVE-2009-2564)
- A cross-site scripting issue when the browser plugin in used with Google Chrome and Opera browsers.
(CVE-2007-0048, CVE-2007-0045)
Solution
Upgrade to Adobe Reader 9.2 / 8.1.7 / 7.1.4 or later.See Also
http://www.adobe.com/support/security/bulletins/apsb09-15.html
Plugin Details
Severity: High
ID: 42120
File Name: adobe_reader_apsb09-15.nasl
Version: 1.25
Type: local
Agent: windows
Family: Windows
Published: 10/14/2009
Updated: 6/27/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.4
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 8.1
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:adobe:acrobat_reader
Required KB Items: SMB/Acroread/Version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 10/13/2009
Vulnerability Publication Date: 10/9/2009
Exploitable With
Core Impact
Metasploit (Adobe FlateDecode Stream Predictor 02 Integer Overflow)
Reference Information
CVE: CVE-2007-0045, CVE-2007-0048, CVE-2009-2564, CVE-2009-2979, CVE-2009-2980, CVE-2009-2981, CVE-2009-2982, CVE-2009-2983, CVE-2009-2986, CVE-2009-2987, CVE-2009-2988, CVE-2009-2990, CVE-2009-2991, CVE-2009-2992, CVE-2009-2993, CVE-2009-2994, CVE-2009-2996, CVE-2009-2997, CVE-2009-2998, CVE-2009-3431, CVE-2009-3458, CVE-2009-3459
BID: 21858, 35740, 36600, 36664, 36665, 36667, 36668, 36669, 36671, 36677, 36678, 36680, 36681, 36682, 36683, 36686, 36687, 36688, 36689, 36690, 36692, 36695