Short Name |
HTTP:STC:ADOBE:PDF-GETANNOTS
|
Severity |
High
|
Recommended |
No
|
Recommended Action |
Drop
|
Category |
HTTP
|
Keywords |
Adobe Acrobat Reader PDF JavaScript getAnnots Method
|
Release Date |
2010/09/22
|
Update Number |
1777
|
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+
|
HTTP: Adobe Acrobat Reader PDF JavaScript getAnnots Method
This signature detects attempts to exploit a known vulnerability in Adobe Acrobat Reader. A successful attack can lead to an integer overflow and arbitrary remote code execution within the context of the client.
Extended Description
Adobe Reader is prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the application or crash the application, denying service to legitimate users.
Reader 8.1.4 and 9.1 for Linux are vulnerable; other versions or platforms may also be affected.
UPDATE (April 28, 2009): The vendor is investigating this issue. We will update this BID as more information emerges.
UPDATE (May 1, 2009): The vendor indicates that fixes will be available by May 12, 2009. Please see the referenced advisory for more information.
UPDATE (May 18, 2009): The vendor indicates that fixes for Adobe Reader 7 for Apple Mac OS X will be available by the end of June, 2009. Please see the updated advisory for more information.
Affected Products
- Adobe Reader 7.0.0
- Adobe Reader 7.0.1
- Adobe Reader 7.0.2
- Adobe Reader 7.0.3
- Adobe Reader 7.0.4
- Adobe Reader 7.0.5
- Adobe Reader 7.0.6
- Adobe Reader 7.0.7
- Adobe Reader 7.0.8
- Adobe Reader 7.0.9
- Adobe Reader 7.1
- Adobe Reader 7.1.1
- Adobe Reader 8.0
- Adobe Reader 8.1
- Adobe Reader 8.1.1
- Adobe Reader 8.1.2
- Adobe Reader 8.1.2 Security Update 1
- Adobe Reader 8.1.3
- Adobe Reader 8.1.4
- Adobe Reader 9
- Adobe Reader 9.1
- Avaya Interactive Response 3.0
- Avaya Interactive Response 4.0
- Gentoo Linux
- Nortel Networks Self-Service MPS 1000
- Nortel Networks Self-Service MPS 500
- Nortel Networks Self-Service Peri Application
- Nortel Networks Self-Service Speech Server
- Red Hat Desktop Extras 3
- Red Hat Desktop Extras 4
- Red Hat Enterprise Linux AS Extras 3
- Red Hat Enterprise Linux AS Extras 4
- Red Hat Enterprise Linux Desktop Supplementary 5 Client
- Red Hat Enterprise Linux ES Extras 3
- Red Hat Enterprise Linux ES Extras 4
- Red Hat Enterprise Linux Extras 3
- Red Hat Enterprise Linux Extras 4
- Red Hat Enterprise Linux Supplementary 5 Server
- Red Hat Enterprise Linux WS Extras 3
- Red Hat Enterprise Linux WS Extras 4
- Sun Solaris 10 Sparc
- SuSE openSUSE 10.3
- SuSE openSUSE 11.0
- SuSE openSUSE 11.1
- SuSE SUSE Linux Enterprise 10
- SuSE SUSE Linux Enterprise 11
- SuSE SUSE Linux Enterprise Desktop 10 SP2
- SuSE SUSE Linux Enterprise Server 11
- SuSE SUSE Linux Enterprise Server 11 DEBUGINFO
References