Signature Detail

HTTP: Adobe PDF Function Obfuscation

This signature detects PDF files that have been obfuscated in order to evade attack detection by anti-virus or by an IPS device. Detections on this signature can indicate that an attacker is trying to exploit a vulnerability in a victim's system.

Extended Description

Adobe Reader and Acrobat are prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code. Failed exploit attempts will likely cause denial-of-service conditions. This issue affects Reader and Acrobat 9.2 and prior versions.

Affected Products

• Adobe Acrobat 6.0.1
• Adobe Acrobat 7.0.9
• Adobe Acrobat 9.1.1
• Adobe Acrobat 9.2
• Adobe Acrobat Professional 8.0
• Adobe Acrobat Professional 8.1
• Adobe Acrobat Professional 8.1.1
• Adobe Acrobat Professional 8.1.2
• Adobe Acrobat Professional 8.1.3
• Adobe Acrobat Professional 8.1.4
• Adobe Acrobat Professional 8.1.6
• Adobe Acrobat Professional 8.1.7
• Adobe Acrobat Professional 9
• Adobe Acrobat Professional 9.1
• Adobe Acrobat Professional 9.1.2
• Adobe Acrobat Professional 9.1.3
• Adobe Acrobat Professional 9.2
• Adobe Acrobat Standard 8.0
• Adobe Acrobat Standard 8.1
• Adobe Acrobat Standard 8.1.1
• Adobe Acrobat Standard 8.1.2
• Adobe Acrobat Standard 8.1.3
• Adobe Acrobat Standard 8.1.4
• Adobe Acrobat Standard 8.1.6
• Adobe Acrobat Standard 8.1.7
• Adobe Acrobat Standard 9
• Adobe Acrobat Standard 9.1
• Adobe Acrobat Standard 9.1.2
• Adobe Acrobat Standard 9.1.3
• Adobe Acrobat Standard 9.2
• Adobe Reader 6.0.1
• Adobe Reader 7.0.9
• Adobe Reader 8.0
• Adobe Reader 8.1
• Adobe Reader 8.1.1
• Adobe Reader 8.1.2
• Adobe Reader 8.1.3
• Adobe Reader 8.1.4
• Adobe Reader 8.1.5
• Adobe Reader 8.1.6
• Adobe Reader 8.1.7
• Adobe Reader 9
• Adobe Reader 9.1
• Adobe Reader 9.1.1
• Adobe Reader 9.1.2
• Adobe Reader 9.1.3
• Adobe Reader 9.2
• Gentoo Linux
• Red Hat Desktop Extras 3
• Red Hat Desktop Extras 4
• Red Hat Enterprise Linux AS Extras 3
• Red Hat Enterprise Linux AS Extras 4
• Red Hat Enterprise Linux Desktop Supplementary 5 Client
• Red Hat Enterprise Linux ES Extras 3
• Red Hat Enterprise Linux ES Extras 4
• Red Hat Enterprise Linux Extras 3
• Red Hat Enterprise Linux Extras 4
• Red Hat Enterprise Linux Supplementary 5 Server
• Red Hat Enterprise Linux WS Extras 3
• Red Hat Enterprise Linux WS Extras 4
• SuSE openSUSE 11.0
• SuSE openSUSE 11.1
• SuSE openSUSE 11.2
• SuSE SUSE Linux Enterprise 10 SP2
• SuSE SUSE Linux Enterprise 10 SP3
• SuSE SUSE Linux Enterprise Desktop 11

References

• CVE: CVE-2009-4324
• CVE: CVE-2009-4324
• CVE: CVE-2010-2883
• URL: http://www.adobe.com/support/security/advisories/apsa09-07.html