Vulnerabilities > CVE-2014-0511 - Buffer Errors vulnerability in Adobe Acrobat Reader 11.0.6

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
adobe
CWE-119
critical
nessus
NVD
Published: 2014-03-27
Updated: 2014-05-16

Summary

Heap-based buffer overflow in Adobe Reader 11.0.06 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.

Vulnerable Configurations

Part Description Count
Application
Adobe
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyWindows
    NASL idADOBE_READER_APSB14-15.NASL
    descriptionThe version of Adobe Reader installed on the remote host is a version prior to 10.1.10 / 11.0.07. It is, therefore, affected by multiple vulnerabilities : - A heap overflow vulnerability exists that could lead to code execution. (CVE-2014-0511) - A security bypass vulnerability exists with input validation. (CVE-2014-0512) - An information disclosure vulnerability exists with the JavaScript APIs. (CVE-2014-0521) - Multiple memory corruption vulnerabilities exists that could lead to code execution. (CVE-2014-0522, CVE-2014-0523, CVE-2014-0524, CVE-2014-0526) - A vulnerability exists with how Reader handles a certain API call that could lead to code execution. (CVE-2014-0525) - A use-after-free vulnerability exists that could lead to code execution. (CVE-2014-0527) - A double-free vulnerability exists that could lead to code execution. (CVE-2014-0528) - A buffer overflow vulnerability exists that could lead to code execution. (CVE-2014-0529) Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id74012
    published2014-05-14
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/74012
    titleAdobe Reader < 10.1.10 / 11.0.07 Multiple Vulnerabilities (APSB14-15)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(74012);
  script_version("1.10");
  script_cvs_date("Date: 2018/06/27 18:42:27");

  script_cve_id(
    "CVE-2014-0511",
    "CVE-2014-0512",
    "CVE-2014-0521",
    "CVE-2014-0522",
    "CVE-2014-0523",
    "CVE-2014-0524",
    "CVE-2014-0525",
    "CVE-2014-0526",
    "CVE-2014-0527",
    "CVE-2014-0528",
    "CVE-2014-0529"
  );
  script_bugtraq_id(
    66205,
    66512,
    67360,
    67362,
    67363,
    67365,
    67366,
    67367,
    67368,
    67369,
    67370
  );

  script_name(english:"Adobe Reader < 10.1.10 / 11.0.07 Multiple Vulnerabilities (APSB14-15)");
  script_summary(english:"Checks version of Adobe Reader");

  script_set_attribute(attribute:"synopsis", value:
"The version of Adobe Reader on the remote Windows host is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Adobe Reader installed on the remote host is a version
prior to 10.1.10 / 11.0.07. It is, therefore, affected by multiple
vulnerabilities :

  - A heap overflow vulnerability exists that could lead to
    code execution. (CVE-2014-0511)

  - A security bypass vulnerability exists with input
    validation. (CVE-2014-0512)

  - An information disclosure vulnerability exists with the
    JavaScript APIs. (CVE-2014-0521)

  - Multiple memory corruption vulnerabilities exists that
    could lead to code execution. (CVE-2014-0522,
    CVE-2014-0523, CVE-2014-0524, CVE-2014-0526)

  - A vulnerability exists with how Reader handles a certain
    API call that could lead to code execution.
    (CVE-2014-0525)

  - A use-after-free vulnerability exists that could lead
    to code execution. (CVE-2014-0527)

  - A double-free vulnerability exists that could lead to
    code execution. (CVE-2014-0528)

  - A buffer overflow vulnerability exists that could lead
    to code execution. (CVE-2014-0529)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/archive/1/532207/30/0/threaded");
  script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/acrobat/apsb14-15.html");
  script_set_attribute(attribute:"solution", value:"Upgrade to Adobe Reader 10.1.10 / 11.0.07 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2014/03/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/05/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/05/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat_reader");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");
  script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");

  script_dependencies("adobe_reader_installed.nasl");
  script_require_keys("SMB/Acroread/Version");
  exit(0);
}

include("audit.inc");
include("global_settings.inc");

info =  '';
info2 = '';
vuln = 0;
vers = get_kb_list('SMB/Acroread/Version');
if (isnull(vers)) audit(AUDIT_KB_MISSING, "SMB/Acroread/Version");

foreach version (vers)
{
  ver = split(version, sep:'.', keep:FALSE);
  for (i=0; i<max_index(ver); i++)
    ver[i] = int(ver[i]);

  path = get_kb_item('SMB/Acroread/'+version+'/Path');
  if (isnull(path)) path = 'n/a';

  verui = get_kb_item('SMB/Acroread/'+version+'/Version_UI');
  if (isnull(verui)) verui = version;

  if (
    (ver[0] == 10 && ver[1] < 1) ||
    (ver[0] == 10 && ver[1] == 1 && ver[2] < 10) ||
    (ver[0] == 11 && ver[1] == 0 && ver[2] < 7)
  )
  {
    vuln++;
    info += '\n  Path              : '+path+
            '\n  Installed version : '+verui+
            '\n  Fixed version     : 10.1.10 / 11.0.07\n';
  }
  else
    info2 += " and " + verui;
}

if (info)
{
  port = get_kb_item("SMB/transport");
  if (!port) port = 445;

  if (report_verbosity > 0)
  {
    if (vuln > 1) s = "s of Adobe Reader are";
    else s = " of Adobe Reader is";

    report =
      '\n' + 'The following vulnerable instance'+s+' installed on the'+
      '\n' + 'remote host :\n'+
      info;
    security_hole(port:port, extra:report);
  }
  else security_hole(port);

  exit(0);
}

if (info2)
{
  info2 -= " and ";
  if (" and " >< info2) be = "are";
  else be = "is";

  exit(0, "The host is not affected since Adobe Reader "+info2+" "+be+" installed.");
}
else exit(1, "Unexpected error - 'info2' is empty.");
  • NASL familyWindows
    NASL idADOBE_ACROBAT_APSB14-15.NASL
    descriptionThe version of Adobe Acrobat installed on the remote host is a version prior to 10.1.10 / 11.0.07. It is, therefore, affected by multiple vulnerabilities : - A heap overflow vulnerability exists that could lead to code execution. (CVE-2014-0511) - A security bypass vulnerability exists with input validation. (CVE-2014-0512) - An information disclosure vulnerability exists with the JavaScript APIs. (CVE-2014-0521) - Multiple memory corruption vulnerabilities exists that could lead to code execution. (CVE-2014-0522, CVE-2014-0523, CVE-2014-0524, CVE-2014-0526) - A vulnerability exists with how Reader handles a certain API call that could lead to code execution. (CVE-2014-0525) - An use-after-free vulnerability exists that could lead to code execution. (CVE-2014-0527) - A double-free vulnerability exists that could lead to code execution. (CVE-2014-0528) - A buffer overflow vulnerability exists that could lead to code execution. (CVE-2014-0529) Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id74011
    published2014-05-14
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/74011
    titleAdobe Acrobat < 10.1.10 / 11.0.07 Multiple Vulnerabilities (APSB14-15)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(74011);
  script_version("1.9");
  script_cvs_date("Date: 2018/06/27 18:42:26");

  script_cve_id(
    "CVE-2014-0511",
    "CVE-2014-0512",
    "CVE-2014-0521",
    "CVE-2014-0522",
    "CVE-2014-0523",
    "CVE-2014-0524",
    "CVE-2014-0525",
    "CVE-2014-0526",
    "CVE-2014-0527",
    "CVE-2014-0528",
    "CVE-2014-0529"
  );
  script_bugtraq_id(
    66205,
    66512,
    67360,
    67362,
    67363,
    67365,
    67366,
    67367,
    67368,
    67369,
    67370
  );

  script_name(english:"Adobe Acrobat < 10.1.10 / 11.0.07 Multiple Vulnerabilities (APSB14-15)");
  script_summary(english:"Checks version of Adobe Acrobat");

  script_set_attribute(attribute:"synopsis", value:
"The version of Adobe Acrobat on the remote Windows host is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Adobe Acrobat installed on the remote host is a version
prior to 10.1.10 / 11.0.07. It is, therefore, affected by multiple
vulnerabilities :

  - A heap overflow vulnerability exists that could lead to
    code execution. (CVE-2014-0511)

  - A security bypass vulnerability exists with input
    validation. (CVE-2014-0512)

  - An information disclosure vulnerability exists with the
    JavaScript APIs. (CVE-2014-0521)

  - Multiple memory corruption vulnerabilities exists that
    could lead to code execution. (CVE-2014-0522,
    CVE-2014-0523, CVE-2014-0524, CVE-2014-0526)

  - A vulnerability exists with how Reader handles a certain
    API call that could lead to code execution.
    (CVE-2014-0525)

  - An use-after-free vulnerability exists that could lead
    to code execution. (CVE-2014-0527)

  - A double-free vulnerability exists that could lead to
    code execution. (CVE-2014-0528)

  - A buffer overflow vulnerability exists that could lead
    to code execution. (CVE-2014-0529)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/archive/1/532207/30/0/threaded");
  script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/acrobat/apsb14-15.html");
  script_set_attribute(attribute:"solution", value:"Upgrade to Adobe Acrobat 10.1.10 / 11.0.07 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2014/03/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/05/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/05/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");
  script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");

  script_dependencies("adobe_acrobat_installed.nasl");
  script_require_keys("SMB/Acrobat/Version");
  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");

version = get_kb_item_or_exit("SMB/Acrobat/Version");
version_ui = get_kb_item("SMB/Acrobat/Version_UI");

if (isnull(version_ui)) version_report = version;
else version_report = version_ui;

ver = split(version, sep:'.', keep:FALSE);
for (i=0; i<max_index(ver); i++)
  ver[i] = int(ver[i]);

path = get_kb_item_or_exit("SMB/Acrobat/Path");

if (
  (ver[0] == 10 && ver[1] < 1) ||
  (ver[0] == 10 && ver[1] == 1 && ver[2] < 10) ||
  (ver[0] == 11 && ver[1] == 0 && ver[2] < 7)
)
{
  port = get_kb_item("SMB/transport");
  if (!port) port = 445;

  if (report_verbosity > 0)
  {
    report =
      '\n  Path              : '+path+
      '\n  Installed version : '+version_report+
      '\n  Fixed version     : 10.1.10 / 11.0.07\n';
    security_hole(port:port, extra:report);
  }
  else security_hole(port);
}
else audit(AUDIT_INST_PATH_NOT_VULN, "Adobe Acrobat", version_report, path);
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_ADOBE_ACROBAT_APSB14-15.NASL
    descriptionThe version of Adobe Acrobat installed on the remote host is a version prior to 10.1.10 / 11.0.7. It is, therefore, affected by multiple vulnerabilities : - A heap overflow vulnerability exists that could lead to code execution. (CVE-2014-0511) - A security bypass vulnerability exists with input validation. (CVE-2014-0512) - An information disclosure vulnerability exists with the JavaScript APIs. (CVE-2014-0521) - Multiple memory corruption vulnerabilities exists that could lead to code execution. (CVE-2014-0522, CVE-2014-0523, CVE-2014-0524, CVE-2014-0526) - A vulnerability exists with how Reader handles a certain API call that could lead to code execution. (CVE-2014-0525) - A use-after-free vulnerability exists that could lead to code execution. (CVE-2014-0527) - A double-free vulnerability exists that could lead to code execution. (CVE-2014-0528) - A buffer overflow vulnerability exists that could lead to code execution. (CVE-2014-0529) Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id74013
    published2014-05-14
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/74013
    titleAdobe Acrobat < 10.1.10 / 11.0.07 Multiple Vulnerabilities (APSB14-15) (Mac OS X)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(74013);
  script_version("1.9");
  script_cvs_date("Date: 2018/07/14  1:59:36");

  script_cve_id(
    "CVE-2014-0511",
    "CVE-2014-0512",
    "CVE-2014-0521",
    "CVE-2014-0522",
    "CVE-2014-0523",
    "CVE-2014-0524",
    "CVE-2014-0525",
    "CVE-2014-0526",
    "CVE-2014-0527",
    "CVE-2014-0528",
    "CVE-2014-0529"
  );
  script_bugtraq_id(
    66205,
    66512,
    67360,
    67362,
    67363,
    67365,
    67366,
    67367,
    67368,
    67369,
    67370
  );

  script_name(english:"Adobe Acrobat < 10.1.10 / 11.0.07 Multiple Vulnerabilities (APSB14-15) (Mac OS X)");
  script_summary(english:"Checks version of Adobe Acrobat");

  script_set_attribute(attribute:"synopsis", value:
"The version of Adobe Acrobat on the remote Mac OS X host is affected
by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Adobe Acrobat installed on the remote host is a version
prior to 10.1.10 / 11.0.7. It is, therefore, affected by multiple
vulnerabilities :

  - A heap overflow vulnerability exists that could lead to
    code execution. (CVE-2014-0511)

  - A security bypass vulnerability exists with input
    validation. (CVE-2014-0512)

  - An information disclosure vulnerability exists with the
    JavaScript APIs. (CVE-2014-0521)

  - Multiple memory corruption vulnerabilities exists that
    could lead to code execution. (CVE-2014-0522,
    CVE-2014-0523, CVE-2014-0524, CVE-2014-0526)

  - A vulnerability exists with how Reader handles a certain
    API call that could lead to code execution.
    (CVE-2014-0525)

  - A use-after-free vulnerability exists that could lead
    to code execution. (CVE-2014-0527)

  - A double-free vulnerability exists that could lead to
    code execution. (CVE-2014-0528)

  - A buffer overflow vulnerability exists that could lead
    to code execution. (CVE-2014-0529)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/archive/1/532207/30/0/threaded");
  script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/acrobat/apsb14-15.html");
  script_set_attribute(attribute:"solution", value:"Upgrade to Adobe Acrobat 10.1.10 / 11.0.07 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2014/03/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/05/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/05/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");

  script_dependencies("macosx_adobe_acrobat_installed.nbin");
  script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version", "MacOSX/Adobe_Acrobat/Installed");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");

get_kb_item_or_exit("Host/local_checks_enabled");

os = get_kb_item("Host/MacOSX/Version");
if (!os) audit(AUDIT_OS_NOT, "Mac OS X");

kb_base = "MacOSX/Adobe_Acrobat";
get_kb_item_or_exit(kb_base+"/Installed");

versions = get_kb_list(kb_base+"/*/Version");
if (isnull(versions)) audit(AUDIT_KB_MISSING , kb_base + '/*/Version');

info = "";
info2 = "";
vuln = 0;

foreach install (sort(keys(versions)))
{
  path = "/Applications" + (install - kb_base - "/Version");

  version = versions[install];

  ver = split(version, sep:".", keep:FALSE);
  for (i=0; i<max_index(ver); i++)
    ver[i] = int(ver[i]);

  if (
    (ver[0] == 10 && ver[1] < 1) ||
    (ver[0] == 10 && ver[1] == 1 && ver[2] < 10) ||
    (ver[0] == 11 && ver[1] == 0 && ver[2] < 7)
  )
  {
    vuln++;
    info +=
      '\n  Path              : ' + path +
      '\n  Installed version : ' + version +
      '\n  Fixed version     : 10.1.10 / 11.0.07\n' +
      '\n';
  }
  else info2 += " and " + version;
}

if (info)
{
  if (report_verbosity > 0) security_hole(port:0, extra:info);
  else security_hole(0);

  exit(0);
}

if (info2)
{
 info2 -= " and ";
  if (" and " >< info2) be = "are";
  else be = "is";

  exit(0, "The host is not affected since Adobe Acrobat " + info2 + " " + be + " installed.");
}
else exit(1, "Unexpected error - 'info2' is empty.");
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_ADOBE_READER_APSB14-15.NASL
    descriptionThe version of Adobe Reader installed on the remote host is a version prior to 10.1.10 or 11.0.07. It is, therefore, affected by multiple vulnerabilities : - A heap overflow condition exists that allows an attacker to execute arbitrary code. (CVE-2014-0511) - A security bypass vulnerability exists due to improper validation of input. (CVE-2014-0512) - An information disclosure vulnerability exists in the implementation of the JavaScript APIs. (CVE-2014-0521) - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2014-0522, CVE-2014-0523, CVE-2014-0524, CVE-2014-0526) - A code execution vulnerability exists due to a failure to prevent access to unmapped memory. An attacker can exploit this to execute arbitrary code via unspecified API calls. (CVE-2014-0525) - A use-after-free error exists that allows an attacker to execute arbitrary code. (CVE-2014-0527) - A double-free error exists that allows an attacker to execute arbitrary code. (CVE-2014-0528) - A buffer overflow condition exists that allows an attacker to execute arbitrary code. (CVE-2014-0529) Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id74014
    published2014-05-14
    reporterThis script is Copyright (C) 2014-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/74014
    titleAdobe Reader < 10.1.10 / 11.0.07 Multiple Vulnerabilities (APSB14-15) (Mac OS X)
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(74014);
  script_version("1.10");
  script_cvs_date("Date: 2018/07/14  1:59:36");

  script_cve_id(
    "CVE-2014-0511",
    "CVE-2014-0512",
    "CVE-2014-0521",
    "CVE-2014-0522",
    "CVE-2014-0523",
    "CVE-2014-0524",
    "CVE-2014-0525",
    "CVE-2014-0526",
    "CVE-2014-0527",
    "CVE-2014-0528",
    "CVE-2014-0529"
  );
  script_bugtraq_id(
    66205,
    66512,
    67360,
    67362,
    67363,
    67365,
    67366,
    67367,
    67368,
    67369,
    67370
  );

  script_name(english:"Adobe Reader < 10.1.10 / 11.0.07 Multiple Vulnerabilities (APSB14-15) (Mac OS X)");
  script_summary(english:"Checks the version of Adobe Reader.");

  script_set_attribute(attribute:"synopsis", value:
"The version of Adobe Reader on the remote Mac OS X host is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Adobe Reader installed on the remote host is a version
prior to 10.1.10 or 11.0.07. It is, therefore, affected by multiple
vulnerabilities :

  - A heap overflow condition exists that allows an attacker
    to execute arbitrary code. (CVE-2014-0511)

  - A security bypass vulnerability exists due to improper
    validation of input. (CVE-2014-0512)

  - An information disclosure vulnerability exists in the
    implementation of the JavaScript APIs. (CVE-2014-0521)

  - Multiple memory corruption issues exist that allow an
    attacker to execute arbitrary code. (CVE-2014-0522,
    CVE-2014-0523, CVE-2014-0524, CVE-2014-0526)

  - A code execution vulnerability exists due to a failure
    to prevent access to unmapped memory. An attacker can
    exploit this to execute arbitrary code via unspecified
    API calls. (CVE-2014-0525)

  - A use-after-free error exists that allows an attacker to
    execute arbitrary code. (CVE-2014-0527)

  - A double-free error exists that allows an attacker to
    execute arbitrary code. (CVE-2014-0528)

  - A buffer overflow condition exists that allows an
    attacker to execute arbitrary code. (CVE-2014-0529)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/archive/1/532207/30/0/threaded");
  script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/acrobat/apsb14-15.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Adobe Reader version 10.1.10 / 11.0.07 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2014/03/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/05/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/05/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat_reader");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");

  script_dependencies("macosx_adobe_reader_installed.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version", "installed_sw/Adobe Reader");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("install_func.inc");
include("misc_func.inc");

if (!get_kb_item("Host/local_checks_enabled"))
  audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

if (!get_kb_item("Host/MacOSX/Version"))
  audit(AUDIT_OS_NOT, "Mac OS X");

app = "Adobe Reader";
install = get_single_install(app_name:app, exit_if_unknown_ver:TRUE);
version = install['version'];
path = install['path'];

ver = split(version, sep:".", keep:FALSE);
for (i=0; i<max_index(ver); i++)
  ver[i] = int(ver[i]);

if (
  (ver[0] == 10 && ver[1] < 1) ||
  (ver[0] == 10 && ver[1] == 1 && ver[2] < 10)
)
  fix = "10.1.10";
else if (ver[0] == 11 && ver[1] == 0 && ver[2] < 7)
  fix = "11.0.07";
else
  fix = "";

if (fix)
{
  info =
    '\n  Path              : ' + path +
    '\n  Installed version : ' + version +
    '\n  Fixed version     : ' + fix +
    '\n';
  security_report_v4(port:0, extra:info, severity:SECURITY_HOLE);
}
else
  audit(AUDIT_INST_PATH_NOT_VULN, app, version, path);

Seebug

bulletinFamilyexploit
descriptionCVE(CAN) ID: CVE-2014-0511 Adobe Reader(也被称为Acrobat Reader)是美国Adobe公司开发的一款优秀的PDF文档阅读软件。 Adobe Reader 11.0.06版本在实现上存在堆缓冲区溢出安全漏洞，可使攻击者利用此漏洞绕过安全限制并执行任意代码。 0 Adobe Reader 11.0.06 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.adobe.com/support/security/
idSSV:61979
last seen2017-11-19
modified2014-03-28
published2014-03-28
reporterRoot
titleAdobe Reader 任意代码执行漏洞

References