[Forgot Password]
Login  Register Subscribe

23631

 
 

122183

 
 

98060

 
 

909

 
 

79198

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2009-1492

Date: (C)2009-04-30   (M)2017-12-06 


The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that contains an annotation, and has an OpenAction entry with JavaScript code that calls this method with crafted integer arguments.

CVSS Score: 9.3Access Vector: NETWORK
Exploit Score: 8.6Access Complexity: MEDIUM
Impact Score: 10.0Authentication: NONE
 Confidentiality: COMPLETE
 Integrity: COMPLETE
 Availability: COMPLETE





Reference:
SECTRACK-1022139
SUNALERT-259028
BID-34736
SECUNIA-34924
SECUNIA-35055
SECUNIA-35096
SECUNIA-35152
SECUNIA-35358
SECUNIA-35416
SECUNIA-35734
OSVDB-54130
EXPLOIT-DB-8569
ADV-2009-1189
ADV-2009-1317
GLSA-200907-06
RHSA-2009:0478
SUSE-SA:2009:027
SUSE-SR:2009:011
TA09-133B
VU#970180
http://blogs.adobe.com/psirt/2009/04/potential_adobe_reader_issue.html
http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html
http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.html
http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txt
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=926953
http://www.adobe.com/support/security/bulletins/apsb09-06.html
reader-getannots-code-execution(50145)

CPE    30
cpe:/a:adobe:acrobat:5.0.6
cpe:/a:adobe:acrobat:7.0
cpe:/a:adobe:acrobat:7.0.1
cpe:/a:adobe:acrobat:7.0.5
...
CWE    1
CWE-399
OVAL    6
oval:org.secpod.oval:def:33396
oval:org.secpod.oval:def:33405
oval:org.secpod.oval:def:400087
oval:org.secpod.oval:def:18634
...

© 2013 SecPod Technologies