|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
[sec-adv] Adobe Acrobat PDF Document Arbitrary Code Execution Vulnerability
From: Secunia Security Advisories (sec-adv
secunia.com)
Date: Wed May 07 2003 - 04:16:09 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
TITLE:
Adobe Acrobat PDF Document Arbitrary Code Execution Vulnerability
READ ONLINE:
http://www.secunia.com/advisories/8739/
CRITICAL:
Moderately critical
IMPACT:
System access
WHERE:
From remote
SOFTWARE:
Adobe Acrobat 5.x
DESCRIPTION:
Adobe has reported a vulnerability in Acrobat, which can be exploited
by a malicious person to compromise a user's system.
The vulnerability is caused due to an error in the JavaScript parsing
engine. A malicious person can exploit this to write arbitrary code
into the "Plug_ins" folder, which potentially will be installed
automatically and executed the next time Acrobat is launched.
Successful exploitation requires that a user is tricked into opening
a specially crafted PDF document.
A known non-harmful virus is currently exploiting the vulnerability
(see: "Other References" for more information).
NOTE: The vulnerability does not affect the free version (Adobe
Acrobat Reader).
SOLUTION:
Upgrade to Adobe Acrobat 6.0 or apply patch.
Adobe Acrobat 5.0.5 Security, Accessibility, and Forms patch:
http://www.adobe.com/support/downloads/thankyou.jsp?ftpID=2121&fileID=2065
Furthermore, normal users should not have write permissions for the
plug-ins folder (default: "\Program Files\Adobe\Acrobat
5.0\Acrobat\Plug_ins").
ORIGINAL ADVISORY:
http://www.adobe.com/support/downloads/detail.jsp?ftpID=2121
OTHER REFERENCES:
Description of known virus exploiting the vulnerability:
http://vil.nai.com/vil/content/v_100269.htm
----------------------------------------------------------------------
Secunia recommends that you verify all advisories you receive, by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
Contact details:
Web : http://www.secunia.com/
E-mail : supportsecunia.com
Tel : +44 (0) 20 7016 2693
Fax : +44 (0) 20 7637 0419
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
----------------------------------------------------------------------
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]