Vulnerabilities > CVE-2007-5659 - Classic Buffer Overflow vulnerability in Adobe Acrobat
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with long arguments to unspecified JavaScript methods. NOTE: this issue might be subsumed by CVE-2008-0655.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Exploit-Db
description Adobe Collab.collectEmailInfo() Buffer Overflow. CVE-2007-5659. Local exploit for windows platform id EDB-ID:16674 last seen 2016-02-02 modified 2010-09-25 published 2010-09-25 reporter metasploit source https://www.exploit-db.com/download/16674/ title Adobe Collab.collectEmailInfo Buffer Overflow description Adobe Acrobat and Reader 8.1.1 Multiple Arbitrary Code Execution and Security Vulnerabilities. CVE-2007-5659. Dos exploit for windows platform id EDB-ID:31114 last seen 2016-02-03 modified 2008-02-06 published 2008-02-06 reporter Paul Craig source https://www.exploit-db.com/download/31114/ title Adobe Acrobat and Reader <= 8.1.1 - Multiple Arbitrary Code Execution and Security Vulnerabilities
Metasploit
description | This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional 8.1.1. By creating a specially crafted pdf that a contains malformed Collab.collectEmailInfo() call, an attacker may be able to execute arbitrary code. |
id | MSF:EXPLOIT/WINDOWS/FILEFORMAT/ADOBE_COLLECTEMAILINFO |
last seen | 2020-03-23 |
modified | 2020-01-15 |
published | 2009-03-28 |
references | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5659 |
reporter | Rapid7 |
source | https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/fileformat/adobe_collectemailinfo.rb |
title | Adobe Collab.collectEmailInfo() Buffer Overflow |
Nessus
NASL family Windows NASL id ADOBE_ACROBAT_812.NASL description The version of Adobe Acrobat installed on the remote host is earlier than 8.1.2 or 7.1.0. Such versions are reportedly affected by multiple vulnerabilities : - A design error vulnerability may allow an attacker to gain control of a user last seen 2020-06-01 modified 2020-06-02 plugin id 40800 published 2009-08-28 reporter This script is Copyright (C) 2009-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/40800 title Adobe Acrobat < 8.1.2 / 7.1.0 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(40800); script_version("1.16"); script_cve_id( #"CVE-2007-4768", heap overflow in PCRE library "CVE-2007-5659", "CVE-2007-5663", "CVE-2007-5666", "CVE-2008-0655", "CVE-2008-0667", "CVE-2008-0726", "CVE-2008-2042"); script_bugtraq_id(27641); script_name(english:"Adobe Acrobat < 8.1.2 / 7.1.0 Multiple Vulnerabilities"); script_summary(english:"Checks version of Adobe Acrobat"); script_set_attribute(attribute:"synopsis", value: "The version of Adobe Acrobat on the remote Windows host is affected by multiple vulnerabilities." ); script_set_attribute( attribute:"description", value:"The version of Adobe Acrobat installed on the remote host is earlier than 8.1.2 or 7.1.0. Such versions are reportedly affected by multiple vulnerabilities : - A design error vulnerability may allow an attacker to gain control of a user's printer. - Multiple stack-based buffer overflows may allow an attacker to execute arbitrary code subject to the user's privileges. - Insecure loading of 'Security Provider' libraries may allow for arbitrary code execution. - An insecure method exposed by the JavaScript library in the 'EScript.api' plug-in allows direct control over low-level features of the object, which allows for execution of arbitrary code as the current user. - Two vulnerabilities in the unpublicized function 'app.checkForUpdate()' exploited through a callback function could lead to arbitrary code execution in Adobe Acrobat 7." ); script_set_attribute( attribute:"see_also", value:"https://www.adobe.com/support/security/advisories/apsa08-01.html" ); script_set_attribute( attribute:"see_also", value:"https://www.adobe.com/support/security/bulletins/apsb08-13.html" ); script_set_attribute( attribute:"solution", value: "Upgrade to Adobe Acrobat 8.1.2 / 7.1.0 or later." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Adobe Collab.collectEmailInfo() Buffer Overflow'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_cwe_id(94, 119, 189, 399); script_set_attribute( attribute:'vuln_publication_date', value:'2008/02/07' ); script_set_attribute( attribute:'patch_publication_date', value:'2008/05/16' ); script_set_attribute( attribute:'plugin_publication_date', value:'2009/08/28' ); script_cvs_date("Date: 2018/11/15 20:50:26"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows"); script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc."); script_dependencies("adobe_acrobat_installed.nasl"); script_require_keys("SMB/Acrobat/Version"); exit(0); } # include("global_settings.inc"); version = get_kb_item("SMB/Acrobat/Version"); if (isnull(version)) exit(1, "The 'SMB/Acrobat/Version' KB item is missing."); if (version =~ "^([0-6]\.|7\.0|8\.(0\.|1\.[01][^0-9.]?))") { version_ui = get_kb_item("SMB/Acrobat/Version_UI"); if (report_verbosity > 0 && version_ui) { path = get_kb_item("SMB/Acrobat/Path"); if (isnull(path)) path = "n/a"; report = string( "\n", " Path : ", path, "\n", " Installed version : ", version_ui, "\n", " Fix : 8.1.2 / 7.1.0\n" ); security_hole(port:get_kb_item("SMB/transport"), extra:report); } else security_hole(get_kb_item("SMB/transport")); } else exit(0, "Acrobat "+version+" is not affected.");
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0144.NASL description Updated acroread packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. The Adobe Reader allows users to view and print documents in portable document format (PDF). Several flaws were found in the way Adobe Reader processed malformed PDF files. An attacker could create a malicious PDF file which could execute arbitrary code if opened by a victim. (CVE-2007-5659, CVE-2007-5663, CVE-2007-5666, CVE-2008-0726) A flaw was found in the way the Adobe Reader browser plug-in honored certain requests. A malicious PDF file could cause the browser to request an unauthorized URL, allowing for a cross-site request forgery attack. (CVE-2007-0044) A flaw was found in Adobe Reader last seen 2020-06-01 modified 2020-06-02 plugin id 40715 published 2009-08-24 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/40715 title RHEL 3 / 4 / 5 : acroread (RHSA-2008:0144) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2008:0144. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(40715); script_version ("1.29"); script_cvs_date("Date: 2019/10/25 13:36:13"); script_cve_id("CVE-2007-0044", "CVE-2007-5659", "CVE-2007-5663", "CVE-2007-5666", "CVE-2008-0655", "CVE-2008-0667", "CVE-2008-0726"); script_bugtraq_id(21858, 27641); script_xref(name:"RHSA", value:"2008:0144"); script_name(english:"RHEL 3 / 4 / 5 : acroread (RHSA-2008:0144)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated acroread packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. The Adobe Reader allows users to view and print documents in portable document format (PDF). Several flaws were found in the way Adobe Reader processed malformed PDF files. An attacker could create a malicious PDF file which could execute arbitrary code if opened by a victim. (CVE-2007-5659, CVE-2007-5663, CVE-2007-5666, CVE-2008-0726) A flaw was found in the way the Adobe Reader browser plug-in honored certain requests. A malicious PDF file could cause the browser to request an unauthorized URL, allowing for a cross-site request forgery attack. (CVE-2007-0044) A flaw was found in Adobe Reader's JavaScript API DOC.print function. A malicious PDF file could silently trigger non-interactive printing of the document, causing multiple copies to be printed without the users consent. (CVE-2008-0667) Additionally, this update fixes multiple unknown flaws in Adobe Reader. When the information regarding these flaws is made public by Adobe, it will be added to this advisory. (CVE-2008-0655) Note: Adobe have yet to release security fixed versions of Adobe 7. All users of Adobe Reader are, therefore, advised to install these updated packages. They contain Adobe Reader version 8.1.2, which is not vulnerable to these issues." ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2007-0044" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2007-5659" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2007-5663" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2007-5666" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2008-0655" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2008-0667" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2008-0726" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2008:0144" ); script_set_attribute( attribute:"solution", value:"Update the affected acroread and / or acroread-plugin packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Adobe Collab.collectEmailInfo() Buffer Overflow'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"exploit_framework_canvas", value:"true"); script_set_attribute(attribute:"canvas_package", value:'CANVAS'); script_cwe_id(94, 119, 189, 352, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:acroread"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:acroread-plugin"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:3"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4.6"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5.1"); script_set_attribute(attribute:"vuln_publication_date", value:"2007/01/03"); script_set_attribute(attribute:"patch_publication_date", value:"2008/02/22"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/08/24"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^(3|4|5)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 3.x / 4.x / 5.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); if (cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i386", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2008:0144"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (rpm_check(release:"RHEL3", cpu:"i386", reference:"acroread-8.1.2-1.el3.6")) flag++; if (rpm_check(release:"RHEL3", cpu:"i386", reference:"acroread-plugin-8.1.2-1.el3.6")) flag++; if (rpm_check(release:"RHEL4", cpu:"i386", reference:"acroread-8.1.2-1.el4.2")) flag++; if (rpm_check(release:"RHEL4", cpu:"i386", reference:"acroread-plugin-8.1.2-1.el4.2")) flag++; if (rpm_check(release:"RHEL5", cpu:"i386", reference:"acroread-plugin-8.1.2-1.el5.3")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "acroread / acroread-plugin"); } }
NASL family Windows NASL id ADOBE_READER_812.NASL description The version of Adobe Reader installed on the remote host is earlier than 8.1.2 or 7.1.0. Such versions are reportedly affected by multiple vulnerabilities : - A design error vulnerability may allow an attacker to gain control of a user last seen 2020-06-01 modified 2020-06-02 plugin id 30200 published 2008-02-06 reporter This script is Copyright (C) 2008-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/30200 title Adobe Reader < 7.1.0 / 8.1.2 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(30200); script_version("1.36"); script_cvs_date("Date: 2018/11/15 20:50:26"); script_cve_id( #"CVE-2007-4768", heap overflow in PCRE library "CVE-2007-5659", "CVE-2007-5663", "CVE-2007-5666", "CVE-2008-0655", "CVE-2008-0667", "CVE-2008-0726", "CVE-2008-2042" ); script_bugtraq_id(27641); script_name(english:"Adobe Reader < 7.1.0 / 8.1.2 Multiple Vulnerabilities"); script_summary(english:"Checks version of Adobe Reader"); script_set_attribute(attribute:"synopsis", value: "The PDF file viewer on the remote Windows host is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Adobe Reader installed on the remote host is earlier than 8.1.2 or 7.1.0. Such versions are reportedly affected by multiple vulnerabilities : - A design error vulnerability may allow an attacker to gain control of a user's printer. - Multiple stack-based buffer overflows may allow an attacker to execute arbitrary code subject to the user's privileges. - Insecure loading of 'Security Provider' libraries may allow for arbitrary code execution. - An insecure method exposed by the JavaScript library in the 'EScript.api' plug-in allows direct control over low-level features of the object, which allows for execution of arbitrary code as the current user. - Two vulnerabilities in the unpublicized function 'app.checkForUpdate()' exploited through a callback function could lead to arbitrary code execution in Adobe Reader 7."); # http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=655 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8619fcdc"); # http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=656 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1d74fcf2" ); # http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=657 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4c30fbc0" ); script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-08-004/" ); script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Feb/79" ); script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Feb/103" ); script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Feb/104" ); script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Feb/105" ); script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Feb/146" ); script_set_attribute(attribute:"see_also", value:"https://seclists.org/fulldisclosure/2008/May/140" ); script_set_attribute(attribute:"see_also", value:"https://seclists.org/fulldisclosure/2008/May/141" ); script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/acrobat/release-note/reader-acrobat-8-1-2.html" ); script_set_attribute(attribute:"see_also", value:"https://www.adobe.com/support/security/advisories/apsa08-01.html" ); script_set_attribute(attribute:"see_also", value:"https://www.adobe.com/support/security/bulletins/apsb08-13.html" ); script_set_attribute(attribute:"solution", value:"Upgrade to Adobe Reader 8.1.2 / 7.1.0 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Adobe Collab.collectEmailInfo() Buffer Overflow'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_cwe_id(94, 119, 189, 399); script_set_attribute(attribute:"patch_publication_date", value:"2008/02/07"); script_set_attribute(attribute:"plugin_publication_date", value:"2008/02/06"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat_reader"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows"); script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc."); script_dependencies("adobe_reader_installed.nasl"); script_require_keys("SMB/Acroread/Version"); exit(0); } include("global_settings.inc"); include("audit.inc"); info = NULL; vers = get_kb_list('SMB/Acroread/Version'); if (isnull(vers)) exit(0, 'The "SMB/Acroread/Version" KB item is missing.'); foreach ver (vers) { if (ver && ver =~ "^([0-6]\.|7\.0|8\.(0\.|1\.[01][^0-9.]?))") { path = get_kb_item('SMB/Acroread/'+ver+'/Path'); if (isnull(path)) exit(1, 'The "SMB/Acroread/'+ver+'/Path" KB item is missing.'); verui = get_kb_item('SMB/Acroread/'+ver+'/Version_UI'); if (isnull(verui)) exit(1, 'The "SMB/Acroread/'+ver+'/Version_UI" KB item is missing.'); info += ' - ' + verui + ', under ' + path + '\n'; } } if (isnull(info)) exit(0, 'The remote host is not affected.'); if (report_verbosity > 0) { if (max_index(split(info)) > 1) s = "s of Adobe Reader are"; else s = " of Adobe Reader is"; report = '\nThe following vulnerable instance'+s+' installed on the'+ '\nremote host :\n\n'+ info; security_hole(port:get_kb_item("SMB/transport"), extra:report); } else security_hole(get_kb_item("SMB/transport"));
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200803-01.NASL description The remote host is affected by the vulnerability described in GLSA-200803-01 (Adobe Acrobat Reader: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Adobe Acrobat Reader, including: A file disclosure when using file:// in PDF documents (CVE-2007-1199) Multiple buffer overflows in unspecified JavaScript methods (CVE-2007-5659) An unspecified vulnerability in the Escript.api plugin (CVE-2007-5663) An untrusted search path (CVE-2007-5666) Incorrect handling of printers (CVE-2008-0667) An integer overflow when passing incorrect arguments to last seen 2020-06-01 modified 2020-06-02 plugin id 31328 published 2008-03-04 reporter This script is Copyright (C) 2008-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/31328 title GLSA-200803-01 : Adobe Acrobat Reader: Multiple vulnerabilities
Oval
accepted | 2010-09-06T04:15:25.365-04:00 | ||||
class | vulnerability | ||||
contributors |
| ||||
description | Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with long arguments to unspecified JavaScript methods. NOTE: this issue might be subsumed by CVE-2008-0655. | ||||
family | unix | ||||
id | oval:org.mitre.oval:def:9813 | ||||
status | accepted | ||||
submitted | 2010-07-09T03:56:16-04:00 | ||||
title | Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with long arguments to unspecified JavaScript methods. NOTE: this issue might be subsumed by CVE-2008-0655. | ||||
version | 6 |
Packetstorm
data source | https://packetstormsecurity.com/files/download/82999/adobe_collectemailinfo.rb.txt |
id | PACKETSTORM:82999 |
last seen | 2016-12-05 |
published | 2009-11-26 |
reporter | MC |
source | https://packetstormsecurity.com/files/82999/Adobe-Collab.collectEmailInfo-Buffer-Overflow.html |
title | Adobe Collab.collectEmailInfo() Buffer Overflow |
Redhat
advisories |
| ||||
rpms |
|
Saint
bid | 27641 |
description | Adobe Acrobat and Reader JavaScript buffer overflow |
id | misc_acroread,misc_acrobat |
osvdb | 41495 |
title | adobe_acrobat_javascript |
type | client |
Seebug
bulletinFamily | exploit |
description | BUGTRAQ ID: 27641 CVE(CAN) ID: CVE-2007-5659,CVE-2007-5663,CVE-2007-5666,CVE-2008-0655,CVE-2008-0667,CVE-2008-0726 Adobe Acrobat和Reader都是流行的PDF文件阅读器。 Adobe Reader/Acrobat中的多个安全漏洞可能允许攻击者导致拒绝服务或完全入侵用户系统。 1) 一些JavaScript方式中的多个栈溢出漏洞允许用户通过特制的.PDF文件导致执行任意指令。目前这个漏洞正在被积极的利用。 2) EScript.api中不安全的JavaScript方式允许通过特制的.PDF文件导致执行任意指令。 3) 加载Security Provider库时存在漏洞,如果用户受骗在包含有与Security Provider库同名的恶意库的目录中打开了PDF文件的话,就会导致执行任意指令。 4) DOC.print()中不安全的JavaScript方式允许在用户不知情的情况下打印特制的PDF文件。 5) printSepsWithParams() JavaScript方式中的整数溢出可能会导致内存破坏。 Adobe Acrobat 8 Adobe Reader 8 Adobe Reader 7 临时解决方法: * 禁止web浏览器显示PDF文档 1. 打开Adobe Acrobat或Adobe Reader 2. 打开“编辑”菜单 3. 选择“首选项”选项 4. 选择“互联网”部分 5. 清除选择“在浏览器中显示PDF”复选框 * 禁止在Microsoft Internet Explorer中自动打开PDF文档 如上禁用“在浏览器中显示PDF”功能,然后对Windows注册表执行以下更改: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\AcroExch.Document.7] "EditFlags"=hex:00,00,00,00 * 在Adobe Reader和Acrobat中禁用JavaScript 在Adobe Reader和Acrobat中禁用JavaScript可防止漏洞被利用。可在“通用”首选项对话框中禁用JavaScript(编辑 --> 首选项 --> JavaScript,清除选择“启用Acrobat JavaScript”)。 厂商补丁: Adobe ----- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: <a href=http://www.adobe.com/support/downloads/thankyou.jsp?ftpID=3849&fileID=3603 target=_blank>http://www.adobe.com/support/downloads/thankyou.jsp?ftpID=3849&fileID=3603</a> <a href=http://www.adobe.com/support/downloads/thankyou.jsp?ftpID=3856&fileID=3602 target=_blank>http://www.adobe.com/support/downloads/thankyou.jsp?ftpID=3856&fileID=3602</a> <a href=http://www.adobe.com/products/acrobat/readstep2_servefile.html target=_blank>http://www.adobe.com/products/acrobat/readstep2_servefile.html</a> |
id | SSV:2917 |
last seen | 2017-11-19 |
modified | 2008-02-21 |
published | 2008-02-21 |
reporter | Root |
title | Adobe Acrobat和Reader多个安全漏洞 |
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=657
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=657
- http://secunia.com/advisories/29065
- http://secunia.com/advisories/29065
- http://secunia.com/advisories/29205
- http://secunia.com/advisories/29205
- http://secunia.com/advisories/30840
- http://secunia.com/advisories/30840
- http://security.gentoo.org/glsa/glsa-200803-01.xml
- http://security.gentoo.org/glsa/glsa-200803-01.xml
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-239286-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-239286-1
- http://www.adobe.com/support/security/advisories/apsa08-01.html
- http://www.adobe.com/support/security/advisories/apsa08-01.html
- http://www.adobe.com/support/security/bulletins/apsb08-13.html
- http://www.adobe.com/support/security/bulletins/apsb08-13.html
- http://www.kb.cert.org/vuls/id/666281
- http://www.kb.cert.org/vuls/id/666281
- http://www.redhat.com/support/errata/RHSA-2008-0144.html
- http://www.redhat.com/support/errata/RHSA-2008-0144.html
- http://www.us-cert.gov/cas/techalerts/TA08-043A.html
- http://www.us-cert.gov/cas/techalerts/TA08-043A.html
- http://www.vupen.com/english/advisories/2008/1966/references
- http://www.vupen.com/english/advisories/2008/1966/references
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9813
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9813