This site is deprecated. Please
CLICK HERE for latest updates
Short Name |
HTTP:STC:ADOBE:PDF-JAVASCRIPT
|
Severity |
Warning
|
Recommended |
No
|
Category |
HTTP
|
Keywords |
JavaScript in Adobe PDF
|
Release Date |
2009/04/30
|
Update Number |
1419
|
Supported Platforms |
idp-4.0+, isg-3.1.134269+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+
|
HTTP: JavaScript in Adobe PDF
This signature detects JavaScript in PDF files sent via HTTP. An attacker can embed malicious JavaScript in PDF files that executes if a user interacts with these files. Some known cases resulted in remote arbitrary code execution.
Extended Description
Adobe Reader is prone to a remote code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the application or crash the application, denying service to legitimate users.
Reader 8.1.4 and 9.1 for Linux are vulnerable; other versions or platforms may also be affected.
UPDATE (April 28, 2009): The vendor is investigating this issue. We will update this BID as more information emerges.
UPDATE (May 1, 2009): The vendor indicates that fixes will be available by May 12, 2009. Please see the referenced advisory for more information.
UPDATE (May 18, 2009): The vendor indicates that fixes for Adobe Reader 7 for Apple Mac OS X will be available by the end of June, 2009. Please see the updated advisory for more information.
Affected Products
- Adobe reader 7.0.0
- Adobe reader 7.0.1
- Adobe reader 7.0.2
- Adobe reader 7.0.3
- Adobe reader 7.0.4
- Adobe reader 7.0.5
- Adobe reader 7.0.6
- Adobe reader 7.0.7
- Adobe reader 7.0.8
- Adobe reader 7.0.9
- Adobe reader 7.1
- Adobe reader 7.1.1
- Adobe reader 8.0
- Adobe reader 8.1
- Adobe reader 8.1.1
- Adobe reader 8.1.2
- Adobe reader 8.1.2 Security Update 1
- Adobe reader 8.1.3
- Adobe reader 8.1.4
- Adobe reader 9
- Adobe reader 9.1
- Avaya interactive_response 3.0
- Avaya interactive_response 4.0
- Gentoo linux
- Nortel_networks self-service_mps_1000
- Nortel_networks self-service_mps_500
- Nortel_networks self-service_peri_application
- Nortel_networks self-service_speech_server
- Red_hat desktop_extras 3
- Red_hat desktop_extras 4
- Red_hat enterprise_linux_as_extras 3
- Red_hat enterprise_linux_as_extras 4
- Red_hat enterprise_linux_desktop_supplementary 5 Client
- Red_hat enterprise_linux_es_extras 3
- Red_hat enterprise_linux_es_extras 4
- Red_hat enterprise_linux_extras 3
- Red_hat enterprise_linux_extras 4
- Red_hat enterprise_linux_supplementary 5 Server
- Red_hat enterprise_linux_ws_extras 3
- Red_hat enterprise_linux_ws_extras 4
- Sun solaris 10 Sparc
- Suse opensuse 10.3
- Suse opensuse 11.0
- Suse opensuse 11.1
- Suse suse_linux_enterprise 10
- Suse suse_linux_enterprise 11
- Suse suse_linux_enterprise_desktop 10 SP2
- Suse suse_linux_enterprise_server 11
- Suse suse_linux_enterprise_server 11 DEBUGINFO
References