Signature Detail
Short Name |
HTTP:STC:ADOBE:ACROBAT-URL-DF |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Adobe Acrobat Reader Plugin URL Double Free |
Release Date |
2007/01/08 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Adobe Acrobat Reader Plugin URL Double Free
This signature detects attempts to exploit a known vulnerability against Adobe Acrobat Reader Plugin. The vulnerability is caused due to a memory corruption that happens inside the Plugin for multiple browsers upon processing a URL for a PDF file. A remote unauthenticated attacker can leverage the vulnerability to achieve cross-site scripting attacks.
Extended Description
Adobe Reader Plugin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the visited site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. This issue affects Adobe Reader versions 6 and 7 for Mozilla Firefox, Opera, and Microsoft Internet Explorer. Other versions for other browsers may also be affected.
Affected Products
- Adobe Acrobat 3D
- Adobe Acrobat Elements 7.0.8
- Adobe Acrobat Professional 7.0.0
- Adobe Acrobat Professional 7.0.1
- Adobe Acrobat Professional 7.0.2
- Adobe Acrobat Professional 7.0.3
- Adobe Acrobat Professional 7.0.4
- Adobe Acrobat Professional 7.0.5
- Adobe Acrobat Professional 7.0.6
- Adobe Acrobat Professional 7.0.7
- Adobe Acrobat Professional 7.0.8
- Adobe Acrobat Professional 7.0.9
- Adobe Acrobat Professional 7.1
- Adobe Acrobat Professional 7.1.1
- Adobe Acrobat Professional 7.1.3
- Adobe Acrobat Professional 8.0
- Adobe Acrobat Professional 8.1
- Adobe Acrobat Professional 8.1.1
- Adobe Acrobat Professional 8.1.2
- Adobe Acrobat Professional 8.1.2 Security Update 1
- Adobe Acrobat Professional 8.1.3
- Adobe Acrobat Professional 8.1.4
- Adobe Acrobat Professional 8.1.6
- Adobe Acrobat Professional 9
- Adobe Acrobat Professional 9.1
- Adobe Acrobat Professional 9.1.2
- Adobe Acrobat Professional 9.1.3
- Adobe Acrobat Standard 7.0.0
- Adobe Acrobat Standard 7.0.1
- Adobe Acrobat Standard 7.0.2
- Adobe Acrobat Standard 7.0.3
- Adobe Acrobat Standard 7.0.4
- Adobe Acrobat Standard 7.0.5
- Adobe Acrobat Standard 7.0.6
- Adobe Acrobat Standard 7.0.7
- Adobe Acrobat Standard 7.0.8
- Adobe Acrobat Standard 7.1
- Adobe Acrobat Standard 7.1.1
- Adobe Acrobat Standard 7.1.3
- Adobe Acrobat Standard 8.0
- Adobe Acrobat Standard 8.1
- Adobe Acrobat Standard 8.1.1
- Adobe Acrobat Standard 8.1.2
- Adobe Acrobat Standard 8.1.3
- Adobe Acrobat Standard 8.1.4
- Adobe Acrobat Standard 8.1.6
- Adobe Acrobat Standard 9
- Adobe Acrobat Standard 9.1
- Adobe Acrobat Standard 9.1.2
- Adobe Acrobat Standard 9.1.3
- Adobe Reader 6.0.0
- Adobe Reader 6.0.1
- Adobe Reader 6.0.2
- Adobe Reader 6.0.3
- Adobe Reader 6.0.4
- Adobe Reader 7.0.0
- Adobe Reader 7.0.1
- Adobe Reader 7.0.2
- Adobe Reader 7.0.3
- Adobe Reader 7.0.4
- Adobe Reader 7.0.5
- Adobe Reader 7.0.6
- Adobe Reader 7.0.7
- Adobe Reader 7.0.8
- Adobe Reader 7.1
- Adobe Reader 7.1.1
- Adobe Reader 7.1.2
- Adobe Reader 8.1
- Adobe Reader 8.1.1
- Adobe Reader 8.1.2
- Adobe Reader 8.1.2 Security Update 1
- Adobe Reader 8.1.3
- Adobe Reader 8.1.4
- Adobe Reader 8.1.5
- Adobe Reader 8.1.6
- Adobe Reader 9
- Adobe Reader 9.1
- Adobe Reader 9.1.1
- Adobe Reader 9.1.2
- Adobe Reader 9.1.3
- Avaya Interactive Response 2.0
- Debian Linux 3.1.0
- Debian Linux 3.1.0 Alpha
- Debian Linux 3.1.0 Amd64
- Debian Linux 3.1.0 Arm
- Debian Linux 3.1.0 Hppa
- Debian Linux 3.1.0 Ia-32
- Debian Linux 3.1.0 Ia-64
- Debian Linux 3.1.0 M68k
- Debian Linux 3.1.0 Mips
- Debian Linux 3.1.0 Mipsel
- Debian Linux 3.1.0 Ppc
- Debian Linux 3.1.0 S/390
- Debian Linux 3.1.0 Sparc
- Gentoo app-text/acroread 7.0.8
- Gentoo Linux
- Microsoft Internet Explorer 6.0
- Microsoft Internet Explorer 6.0 SP1
- Mozilla Firefox 1.0.4
- Mozilla Firefox 1.5.0
- Mozilla Firefox 1.5.0.1
- Mozilla Firefox 1.5.0.2
- Mozilla Firefox 1.5.0.3
- Mozilla Firefox 1.5.0.4
- Mozilla Firefox 1.5.0.5
- Mozilla Firefox 1.5.0.6
- Mozilla Firefox 1.5.0.7
- Mozilla Firefox 1.5.0.8
- Mozilla Firefox 1.5.0.9
- Mozilla Firefox 1.5.0 Beta 1
- Mozilla Firefox 1.5.0 Beta 2
- Mozilla Firefox 2.0
- Mozilla Firefox 2.0.0.1
- Mozilla Firefox 2.0 Beta 1
- Mozilla Firefox 2.0 RC2
- Mozilla Firefox 2.0 RC3
- Opera Software Opera Web Browser 9
- Opera Software Opera Web Browser 9.10
- Red Hat Enterprise Linux Desktop Supplementary 5 Client
- Red Hat Enterprise Linux Extras 3
- Red Hat Enterprise Linux Extras 4
- Red Hat Enterprise Linux Supplementary 5 Server
- Sun Solaris 10 Sparc
- SuSE Linux 10.0 X86
- SuSE Linux 10.1 X86
- SuSE Linux 9.3 X86
- SuSE Novell Linux Desktop 9.0.0
- SuSE openSUSE 10.2
- SuSE openSUSE 10.3
- SuSE openSUSE 11.0
- SuSE openSUSE 11.1
- SuSE SUSE Linux Enterprise Desktop 10
- SuSE SUSE Linux Enterprise Desktop 10 SP2
- SuSE SUSE Linux Enterprise Desktop 10 SP3
- SuSE SUSE Linux Enterprise Desktop 11
- Turbolinux FUJI
References