Adobe Reader < 10.1.1 / 9.4.6 / 8.3.1 Multiple Vulnerabilities (APSB11-21, APSB11-24, APSB11-26) (Mac OS X)

high Nessus Plugin ID 56199

Language:

Synopsis

The version of Adobe Reader on the remote Mac OS X host is affected by multiple vulnerabilities.

Description

The version of Adobe Reader installed on the remote Mac OS X host is prior to 10.1.1, 9.4.6, or 8.3.1. It is, therefore, affected by the following vulnerabilities :

- An unspecified error exists that allows an attacker to bypass security restrictions, resulting in code execution. (CVE-2011-2431)

- Multiple buffer overflow conditions exists that allow an attacker to execute arbitrary code. (CVE-2011-2432, CVE-2011-2435)

- Multiple heap overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2011-2433, CVE-2011-2434, CVE-2011-2436, CVE-2011-2437)

- Multiple stack overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2011-2438)

- An error exists related to memory leak issues that allows an attacker to execute arbitrary code.
(CVE-2011-2439)

- A use-after-free error exists that allows an attacker to execute arbitrary code. (CVE-2011-2440)

- Multiple errors exist in the CoolType.dll library that can allow stack overflow conditions, resulting in code execution. (CVE-2011-2441)

- A logic error exists that allows an attacker to execute arbitrary code. (CVE-2011-2442)

- Multiple vulnerabilities exist, as noted in APSB11-21, that can allow an attacker to take control of the affected system or cause the application to crash.
(CVE-2011-2130, CVE-2011-2134, CVE-2011-2135, CVE-2011-2136, CVE-2011-2137, CVE-2011-2138, CVE-2011-2139, CVE-2011-2140, CVE-2011-2414, CVE-2011-2415, CVE-2011-2416, CVE-2011-2417, CVE-2011-2425, CVE-2011-2424)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Adobe Reader version 10.1.1 / 9.4.6 / 8.3.1 or later.

Plugin Details

Severity: High

ID: 56199

File Name: macosx_adobe_reader_apsb11-24.nasl

Version: 1.16

Type: local

Agent: macosx

Family: MacOS X Local Security Checks

Published: 9/14/2011

Updated: 7/14/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.6

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:adobe:acrobat_reader

Required KB Items: Host/local_checks_enabled, Host/MacOSX/Version, installed_sw/Adobe Reader

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/13/2011

Vulnerability Publication Date: 9/13/2011

Exploitable With

Core Impact

Metasploit (Adobe Flash Player MP4 SequenceParameterSetNALUnit Buffer Overflow)

Reference Information

CVE: CVE-2011-1353, CVE-2011-2130, CVE-2011-2134, CVE-2011-2135, CVE-2011-2136, CVE-2011-2137, CVE-2011-2138, CVE-2011-2139, CVE-2011-2140, CVE-2011-2414, CVE-2011-2415, CVE-2011-2416, CVE-2011-2417, CVE-2011-2424, CVE-2011-2425, CVE-2011-2426, CVE-2011-2427, CVE-2011-2428, CVE-2011-2429, CVE-2011-2430, CVE-2011-2431, CVE-2011-2432, CVE-2011-2433, CVE-2011-2434, CVE-2011-2435, CVE-2011-2436, CVE-2011-2437, CVE-2011-2438, CVE-2011-2439, CVE-2011-2440, CVE-2011-2441, CVE-2011-2442, CVE-2011-2444

BID: 49073, 49074, 49075, 49076, 49077, 49079, 49080, 49081, 49082, 49083, 49084, 49085, 49086, 49186, 49572, 49575, 49576, 49577, 49578, 49579, 49580, 49581, 49582, 49583, 49584, 49585, 49586, 49710, 49714, 49715, 49716, 49717, 49718

Detections

Analytics