Test Kennung:	1.3.6.1.4.1.25623.1.0.801095
Kategorie:	Buffer overflow
Titel:	Adobe Reader Multimeda Doc.media.newPlayer Code Execution Vulnerability (Linux)
Zusammenfassung:	This host is installed with Adobe Reader and is prone to Doc.media.newPlayer; Remote Code Execution vulnerability.
Beschreibung:	Summary: This host is installed with Adobe Reader and is prone to Doc.media.newPlayer Remote Code Execution vulnerability. Vulnerability Insight: There exists a flaw in the JavaScript module doc.media object while sending a null argument to the newPlayer() method as the exploitation method makes use of a vpointer that has not been initialized. Vulnerability Impact: Successful exploitation will let attackers to execute arbitrary code and compromise a user's system. Affected Software/OS: Adobe Reader version 9.2.0 and prior. Solution: Upgrade Adobe Reader version 9.3.2 or later. Workaround: Disable JavaScript execution from the Adobe Acrobat/Reader product configuration menu settings. CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Querverweis:	BugTraq ID: 37331 Common Vulnerability Exposure (CVE) ID: CVE-2009-4324 http://www.securityfocus.com/bid/37331 Cert/CC Advisory: TA10-013A http://www.us-cert.gov/cas/techalerts/TA10-013A.html CERT/CC vulnerability note: VU#508357 http://www.kb.cert.org/vuls/id/508357 http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html http://www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rb http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214 http://www.symantec.com/connect/blogs/zero-day-xmas-present http://osvdb.org/60980 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795 http://www.redhat.com/support/errata/RHSA-2010-0060.html http://secunia.com/advisories/37690 http://secunia.com/advisories/38138 http://secunia.com/advisories/38215 SuSE Security Announcement: SUSE-SA:2010:008 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html http://www.vupen.com/english/advisories/2009/3518 http://www.vupen.com/english/advisories/2010/0103 XForce ISS Database: acro-reader-unspecifed-code-execution(54747) https://exchange.xforce.ibmcloud.com/vulnerabilities/54747
Copyright	Copyright (C) 2009 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.