KLA10033 Multiple ACE vulnerabilities in Adobe Acrobat & Reader

Multiple serious vulnerabilities have been found in Adobe Acrobat & Reader.

getAnnots and customDictionaryOpen methods in JavaScript API can be exploited to cause denial of service or execute arbitrary code through a specially designed pdf file.

Original advisories

Adobe bulletin

Exploitation

Public exploits exist for this vulnerability.

Related products

Adobe-Reader

Adobe-Acrobat

CVE list

CVE-2009-1493 high

CVE-2009-1492 critical

Solution

Update to latest version

Reader

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Adobe Acrobat & Reader 9 versions 9.1 and earlierAdobe Acrobat & Reader 8 versions 8.1.4 and earlierAdobe Acrobat & Reader versions 7.1.1 and earlier