VUPEN Security Research Advisory - VUPEN-SR-2009-04
Advisory URL: http://www.vupen.com/english/advisories/2009/1547
June 10, 2009
Adobe Acrobat is a family of computer programs developed by Adobe
Systems, designed to view, create, manipulate and manage files in
Adobe's Portable Document Format (PDF).
VUPEN Security discovered a critical vulnerability affecting Adobe
Acrobat and Reader.
This vulnerability is caused by an integer overflow error within the
JBIG2 filter when processing certain data streams within a PDF file,
which could allow attackers to cause a heap overflow and execute
arbitrary code by tricking a user into opening a specially crafted
document.
Adobe Reader versions prior to 9.1.2
Adobe Reader versions prior to 8.1.6
Adobe Reader versions prior to 7.1.3
Adobe Acrobat Standard versions prior to 9.1.2
Adobe Acrobat Pro versions prior to 9.1.2
Adobe Acrobat Pro Extended versions prior to 9.1.2
Adobe Acrobat versions prior to 8.1.6
Adobe Acrobat versions prior to 7.1.3
A proof-of-concept exploit has have been developed by VUPEN Security
and is available with the in-depth binary analysis of the vulnerability
through the VUPEN Exploits & PoCs Service.
Upgrade to Adobe Reader and Acrobat version 9.1.2, 8.1.6 and 7.1.3 :
http://www.adobe.com/support/security/bulletins/apsb09-07.html
Thse vulnerability was discovered by Nicolas JOLY of VUPEN Security
http://www.vupen.com/english/advisories/2009/1547
http://www.adobe.com/support/security/bulletins/apsb09-07.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0509
07/05/2009 - Vendor notified
07/05/2009 - Vendor response
05/06/2009 - Status update received
10/06/2009 - Coordinated public Disclosure