Vulnerabilities > CVE-2008-0667 - Resource Management Errors vulnerability in Adobe Acrobat Reader

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
adobe
CWE-399
nessus

Summary

The DOC.print function in the Adobe JavaScript API, as used by Adobe Acrobat and Reader before 8.1.2, allows remote attackers to configure silent non-interactive printing, and trigger the printing of an arbitrary number of copies of a document. NOTE: this issue might be subsumed by CVE-2008-0655.

Common Weakness Enumeration (CWE)

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_ACROREAD-5010.NASL
    descriptionThis version update to 8.1.2 fixes numerous bugs, including some security problems. (CVE-2008-0667 / CVE-2008-0655 / CVE-2008-0726)
    last seen2020-06-01
    modified2020-06-02
    plugin id31126
    published2008-02-20
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31126
    titleSuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 5010)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The text description of this plugin is (C) Novell, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(31126);
      script_version ("1.22");
      script_cvs_date("Date: 2019/10/25 13:36:32");
    
      script_cve_id("CVE-2008-0655", "CVE-2008-0667", "CVE-2008-0726");
    
      script_name(english:"SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 5010)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 10 host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This version update to 8.1.2 fixes numerous bugs, including some
    security problems. (CVE-2008-0667 / CVE-2008-0655 / CVE-2008-0726)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-0655.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-0667.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2008-0726.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 5010.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_cwe_id(119, 189, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/02/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/02/20");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled.");
    if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE.");
    if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages.");
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) exit(1, "Failed to determine the architecture type.");
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented.");
    
    
    flag = 0;
    if (rpm_check(release:"SLED10", sp:1, reference:"acroread-8.1.2-1.4")) flag++;
    if (rpm_check(release:"SLED10", sp:1, reference:"acroread_ja-8.1.2-0.2")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else exit(0, "The host is not affected.");
    
  • NASL familyWindows
    NASL idADOBE_ACROBAT_812.NASL
    descriptionThe version of Adobe Acrobat installed on the remote host is earlier than 8.1.2 or 7.1.0. Such versions are reportedly affected by multiple vulnerabilities : - A design error vulnerability may allow an attacker to gain control of a user
    last seen2020-06-01
    modified2020-06-02
    plugin id40800
    published2009-08-28
    reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/40800
    titleAdobe Acrobat < 8.1.2 / 7.1.0 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40800);
      script_version("1.16");
    
      script_cve_id(
        #"CVE-2007-4768",  heap overflow in PCRE library
        "CVE-2007-5659", "CVE-2007-5663", "CVE-2007-5666", "CVE-2008-0655",
        "CVE-2008-0667", "CVE-2008-0726", "CVE-2008-2042");
      script_bugtraq_id(27641);
    
      script_name(english:"Adobe Acrobat < 8.1.2 / 7.1.0 Multiple Vulnerabilities");
      script_summary(english:"Checks version of Adobe Acrobat");
    
      script_set_attribute(attribute:"synopsis", value:
    "The version of Adobe Acrobat on the remote Windows host is affected by
    multiple vulnerabilities."  );
    
       script_set_attribute(
          attribute:"description",
          value:"The version of Adobe Acrobat installed on the remote host is earlier
    than 8.1.2 or 7.1.0.  Such versions are reportedly affected by
    multiple vulnerabilities :
    
      - A design error vulnerability may allow an attacker to
        gain control of a user's printer.
    
      - Multiple stack-based buffer overflows may allow an
        attacker to execute arbitrary code subject to the
        user's privileges.
    
      - Insecure loading of 'Security Provider' libraries may
        allow for arbitrary code execution.
    
      - An insecure method exposed by the JavaScript library
        in the 'EScript.api' plug-in allows direct control
        over low-level features of the object, which allows
        for execution of arbitrary code as the current user.
    
      - Two vulnerabilities in the unpublicized function
        'app.checkForUpdate()' exploited through a callback
        function could lead to arbitrary code execution in
        Adobe Acrobat 7."
      );
    
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.adobe.com/support/security/advisories/apsa08-01.html"
        );
    
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.adobe.com/support/security/bulletins/apsb08-13.html"
      );
    
      script_set_attribute(
        attribute:"solution",
        value: "Upgrade to Adobe Acrobat 8.1.2 / 7.1.0 or later."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Adobe Collab.collectEmailInfo() Buffer Overflow');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_cwe_id(94, 119, 189, 399);
    
      script_set_attribute( attribute:'vuln_publication_date', value:'2008/02/07' );
      script_set_attribute( attribute:'patch_publication_date', value:'2008/05/16' );
      script_set_attribute( attribute:'plugin_publication_date', value:'2009/08/28' );
    
     script_cvs_date("Date: 2018/11/15 20:50:26");
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
    
      script_dependencies("adobe_acrobat_installed.nasl");
      script_require_keys("SMB/Acrobat/Version");
    
      exit(0);
    }
    
    #
    
    include("global_settings.inc");
    
    
    version = get_kb_item("SMB/Acrobat/Version");
    if (isnull(version)) exit(1, "The 'SMB/Acrobat/Version' KB item is missing.");
    
    if (version =~ "^([0-6]\.|7\.0|8\.(0\.|1\.[01][^0-9.]?))")
    {
      version_ui = get_kb_item("SMB/Acrobat/Version_UI");
      if (report_verbosity > 0 && version_ui)
      {
        path = get_kb_item("SMB/Acrobat/Path");
        if (isnull(path)) path = "n/a";
    
        report = string(
          "\n",
          "  Path              : ", path, "\n",
          "  Installed version : ", version_ui, "\n",
          "  Fix               : 8.1.2 / 7.1.0\n"
        );
        security_hole(port:get_kb_item("SMB/transport"), extra:report);
      }
      else security_hole(get_kb_item("SMB/transport"));
    }
    else exit(0, "Acrobat "+version+" is not affected.");
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2008-0144.NASL
    descriptionUpdated acroread packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. The Adobe Reader allows users to view and print documents in portable document format (PDF). Several flaws were found in the way Adobe Reader processed malformed PDF files. An attacker could create a malicious PDF file which could execute arbitrary code if opened by a victim. (CVE-2007-5659, CVE-2007-5663, CVE-2007-5666, CVE-2008-0726) A flaw was found in the way the Adobe Reader browser plug-in honored certain requests. A malicious PDF file could cause the browser to request an unauthorized URL, allowing for a cross-site request forgery attack. (CVE-2007-0044) A flaw was found in Adobe Reader
    last seen2020-06-01
    modified2020-06-02
    plugin id40715
    published2009-08-24
    reporterThis script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/40715
    titleRHEL 3 / 4 / 5 : acroread (RHSA-2008:0144)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2008:0144. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(40715);
      script_version ("1.29");
      script_cvs_date("Date: 2019/10/25 13:36:13");
    
      script_cve_id("CVE-2007-0044", "CVE-2007-5659", "CVE-2007-5663", "CVE-2007-5666", "CVE-2008-0655", "CVE-2008-0667", "CVE-2008-0726");
      script_bugtraq_id(21858, 27641);
      script_xref(name:"RHSA", value:"2008:0144");
    
      script_name(english:"RHEL 3 / 4 / 5 : acroread (RHSA-2008:0144)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated acroread packages that fix several security issues are now
    available for Red Hat Enterprise Linux 3, 4, and 5.
    
    This update has been rated as having critical security impact by the
    Red Hat Security Response Team.
    
    The Adobe Reader allows users to view and print documents in portable
    document format (PDF).
    
    Several flaws were found in the way Adobe Reader processed malformed
    PDF files. An attacker could create a malicious PDF file which could
    execute arbitrary code if opened by a victim. (CVE-2007-5659,
    CVE-2007-5663, CVE-2007-5666, CVE-2008-0726)
    
    A flaw was found in the way the Adobe Reader browser plug-in honored
    certain requests. A malicious PDF file could cause the browser to
    request an unauthorized URL, allowing for a cross-site request forgery
    attack. (CVE-2007-0044)
    
    A flaw was found in Adobe Reader's JavaScript API DOC.print function.
    A malicious PDF file could silently trigger non-interactive printing
    of the document, causing multiple copies to be printed without the
    users consent. (CVE-2008-0667)
    
    Additionally, this update fixes multiple unknown flaws in Adobe
    Reader. When the information regarding these flaws is made public by
    Adobe, it will be added to this advisory. (CVE-2008-0655)
    
    Note: Adobe have yet to release security fixed versions of Adobe 7.
    All users of Adobe Reader are, therefore, advised to install these
    updated packages. They contain Adobe Reader version 8.1.2, which is
    not vulnerable to these issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2007-0044"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2007-5659"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2007-5663"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2007-5666"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2008-0655"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2008-0667"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2008-0726"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2008:0144"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected acroread and / or acroread-plugin packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Adobe Collab.collectEmailInfo() Buffer Overflow');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(94, 119, 189, 352, 399);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:acroread");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:acroread-plugin");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:3");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4.6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2007/01/03");
      script_set_attribute(attribute:"patch_publication_date", value:"2008/02/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2009/08/24");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(3|4|5)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 3.x / 4.x / 5.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    if (cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i386", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2008:0144";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL3", cpu:"i386", reference:"acroread-8.1.2-1.el3.6")) flag++;
    
      if (rpm_check(release:"RHEL3", cpu:"i386", reference:"acroread-plugin-8.1.2-1.el3.6")) flag++;
    
    
      if (rpm_check(release:"RHEL4", cpu:"i386", reference:"acroread-8.1.2-1.el4.2")) flag++;
    
      if (rpm_check(release:"RHEL4", cpu:"i386", reference:"acroread-plugin-8.1.2-1.el4.2")) flag++;
    
    
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"acroread-plugin-8.1.2-1.el5.3")) flag++;
    
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "acroread / acroread-plugin");
      }
    }
    
  • NASL familyWindows
    NASL idADOBE_READER_812.NASL
    descriptionThe version of Adobe Reader installed on the remote host is earlier than 8.1.2 or 7.1.0. Such versions are reportedly affected by multiple vulnerabilities : - A design error vulnerability may allow an attacker to gain control of a user
    last seen2020-06-01
    modified2020-06-02
    plugin id30200
    published2008-02-06
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/30200
    titleAdobe Reader < 7.1.0 / 8.1.2 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(30200);
      script_version("1.36");
      script_cvs_date("Date: 2018/11/15 20:50:26");
    
      script_cve_id(
        #"CVE-2007-4768",  heap overflow in PCRE library
        "CVE-2007-5659",
        "CVE-2007-5663",
        "CVE-2007-5666",
        "CVE-2008-0655",
        "CVE-2008-0667",
        "CVE-2008-0726",
        "CVE-2008-2042"
      );
      script_bugtraq_id(27641);
    
      script_name(english:"Adobe Reader < 7.1.0 / 8.1.2 Multiple Vulnerabilities");
      script_summary(english:"Checks version of Adobe Reader");
    
      script_set_attribute(attribute:"synopsis", value:
    "The PDF file viewer on the remote Windows host is affected by multiple
    vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Adobe Reader installed on the remote host is earlier
    than 8.1.2 or 7.1.0. Such versions are reportedly affected by multiple
    vulnerabilities :
    
      - A design error vulnerability may allow an attacker to
        gain control of a user's printer.
    
      - Multiple stack-based buffer overflows may allow an
        attacker to execute arbitrary code subject to the
        user's privileges.
    
      - Insecure loading of 'Security Provider' libraries may
        allow for arbitrary code execution.
    
      - An insecure method exposed by the JavaScript library
        in the 'EScript.api' plug-in allows direct control
        over low-level features of the object, which allows
        for execution of arbitrary code as the current user.
    
      - Two vulnerabilities in the unpublicized function
        'app.checkForUpdate()' exploited through a callback
        function could lead to arbitrary code execution in
        Adobe Reader 7.");
      # http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=655
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8619fcdc");
      # http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=656
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1d74fcf2" );
      # http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=657
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4c30fbc0" );
      script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-08-004/" );
      script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Feb/79" );
      script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Feb/103" );
      script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Feb/104" );
      script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Feb/105" );
      script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Feb/146" );
      script_set_attribute(attribute:"see_also", value:"https://seclists.org/fulldisclosure/2008/May/140" );
      script_set_attribute(attribute:"see_also", value:"https://seclists.org/fulldisclosure/2008/May/141" );
      script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/acrobat/release-note/reader-acrobat-8-1-2.html" );
      script_set_attribute(attribute:"see_also", value:"https://www.adobe.com/support/security/advisories/apsa08-01.html" );
      script_set_attribute(attribute:"see_also", value:"https://www.adobe.com/support/security/bulletins/apsb08-13.html" );
      script_set_attribute(attribute:"solution", value:"Upgrade to Adobe Reader 8.1.2 / 7.1.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Adobe Collab.collectEmailInfo() Buffer Overflow');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_cwe_id(94, 119, 189, 399);
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/02/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/02/06");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat_reader");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
      script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.");
    
      script_dependencies("adobe_reader_installed.nasl");
      script_require_keys("SMB/Acroread/Version");
      exit(0);
    }
    
    include("global_settings.inc");
    include("audit.inc");
    
    info = NULL;
    vers = get_kb_list('SMB/Acroread/Version');
    if (isnull(vers)) exit(0, 'The "SMB/Acroread/Version" KB item is missing.');
    
    foreach ver (vers)
    {
      if (ver && ver =~ "^([0-6]\.|7\.0|8\.(0\.|1\.[01][^0-9.]?))")
      {
        path = get_kb_item('SMB/Acroread/'+ver+'/Path');
        if (isnull(path)) exit(1, 'The "SMB/Acroread/'+ver+'/Path" KB item is missing.');
    
        verui = get_kb_item('SMB/Acroread/'+ver+'/Version_UI');
        if (isnull(verui)) exit(1, 'The "SMB/Acroread/'+ver+'/Version_UI" KB item is missing.');
    
        info += '  - ' + verui + ', under ' + path + '\n';
      }
    }
    
    if (isnull(info)) exit(0, 'The remote host is not affected.');
    
    if (report_verbosity > 0)
    {
      if (max_index(split(info)) > 1) s = "s of Adobe Reader are";
      else s = " of Adobe Reader is";
    
      report =
        '\nThe following vulnerable instance'+s+' installed on the'+
        '\nremote host :\n\n'+
        info;
      security_hole(port:get_kb_item("SMB/transport"), extra:report);
    }
    else security_hole(get_kb_item("SMB/transport"));
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200803-01.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200803-01 (Adobe Acrobat Reader: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Adobe Acrobat Reader, including: A file disclosure when using file:// in PDF documents (CVE-2007-1199) Multiple buffer overflows in unspecified JavaScript methods (CVE-2007-5659) An unspecified vulnerability in the Escript.api plugin (CVE-2007-5663) An untrusted search path (CVE-2007-5666) Incorrect handling of printers (CVE-2008-0667) An integer overflow when passing incorrect arguments to
    last seen2020-06-01
    modified2020-06-02
    plugin id31328
    published2008-03-04
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31328
    titleGLSA-200803-01 : Adobe Acrobat Reader: Multiple vulnerabilities

Oval

accepted2010-09-06T04:14:49.970-04:00
classvulnerability
contributors
nameAharon Chernin
organizationSCAP.com, LLC
descriptionThe DOC.print function in the Adobe JavaScript API, as used by Adobe Acrobat and Reader before 8.1.2, allows remote attackers to configure silent non-interactive printing, and trigger the printing of an arbitrary number of copies of a document. NOTE: this issue might be subsumed by CVE-2008-0655.
familyunix
idoval:org.mitre.oval:def:9731
statusaccepted
submitted2010-07-09T03:56:16-04:00
titleThe DOC.print function in the Adobe JavaScript API, as used by Adobe Acrobat and Reader before 8.1.2, allows remote attackers to configure silent non-interactive printing, and trigger the printing of an arbitrary number of copies of a document. NOTE: this issue might be subsumed by CVE-2008-0655.
version6

Redhat

advisories
rhsa
idRHSA-2008:0144
rpms
  • acroread-0:8.1.2-1.el3.6
  • acroread-0:8.1.2-1.el4.2
  • acroread-0:8.1.2-1.el5.3
  • acroread-plugin-0:8.1.2-1.el3.6
  • acroread-plugin-0:8.1.2-1.el4.2
  • acroread-plugin-0:8.1.2-1.el5.3

Saint

bid27641
descriptionAdobe Acrobat and Reader JavaScript buffer overflow
idmisc_acroread,misc_acrobat
osvdb41495
titleadobe_acrobat_javascript
typeclient

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 27641 CVE(CAN) ID: CVE-2007-5659,CVE-2007-5663,CVE-2007-5666,CVE-2008-0655,CVE-2008-0667,CVE-2008-0726 Adobe Acrobat和Reader都是流行的PDF文件阅读器。 Adobe Reader/Acrobat中的多个安全漏洞可能允许攻击者导致拒绝服务或完全入侵用户系统。 1) 一些JavaScript方式中的多个栈溢出漏洞允许用户通过特制的.PDF文件导致执行任意指令。目前这个漏洞正在被积极的利用。 2) EScript.api中不安全的JavaScript方式允许通过特制的.PDF文件导致执行任意指令。 3) 加载Security Provider库时存在漏洞,如果用户受骗在包含有与Security Provider库同名的恶意库的目录中打开了PDF文件的话,就会导致执行任意指令。 4) DOC.print()中不安全的JavaScript方式允许在用户不知情的情况下打印特制的PDF文件。 5) printSepsWithParams() JavaScript方式中的整数溢出可能会导致内存破坏。 Adobe Acrobat 8 Adobe Reader 8 Adobe Reader 7 临时解决方法: * 禁止web浏览器显示PDF文档 1. 打开Adobe Acrobat或Adobe Reader 2. 打开“编辑”菜单 3. 选择“首选项”选项 4. 选择“互联网”部分 5. 清除选择“在浏览器中显示PDF”复选框 * 禁止在Microsoft Internet Explorer中自动打开PDF文档 如上禁用“在浏览器中显示PDF”功能,然后对Windows注册表执行以下更改: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\AcroExch.Document.7] &quot;EditFlags&quot;=hex:00,00,00,00 * 在Adobe Reader和Acrobat中禁用JavaScript 在Adobe Reader和Acrobat中禁用JavaScript可防止漏洞被利用。可在“通用”首选项对话框中禁用JavaScript(编辑 --&gt; 首选项 --&gt; JavaScript,清除选择“启用Acrobat JavaScript”)。 厂商补丁: Adobe ----- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: <a href=http://www.adobe.com/support/downloads/thankyou.jsp?ftpID=3849&amp;fileID=3603 target=_blank>http://www.adobe.com/support/downloads/thankyou.jsp?ftpID=3849&amp;fileID=3603</a> <a href=http://www.adobe.com/support/downloads/thankyou.jsp?ftpID=3856&amp;fileID=3602 target=_blank>http://www.adobe.com/support/downloads/thankyou.jsp?ftpID=3856&amp;fileID=3602</a> <a href=http://www.adobe.com/products/acrobat/readstep2_servefile.html target=_blank>http://www.adobe.com/products/acrobat/readstep2_servefile.html</a>
idSSV:2917
last seen2017-11-19
modified2008-02-21
published2008-02-21
reporterRoot
titleAdobe Acrobat和Reader多个安全漏洞