National Cyber-Alert System

Vulnerability Summary for CVE-2009-1492

Overview

The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that contains an annotation, and has an OpenAction entry with JavaScript code that calls this method with crafted integer arguments.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA09-133B

Name: TA09-133B

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA09-133B.html

US-CERT Vulnerability Note: VU#970180

Name: VU#970180

Hyperlink:http://www.kb.cert.org/vuls/id/970180

External Source: XF

Name: reader-getannots-code-execution(50145)

Hyperlink:http://xforce.iss.net/xforce/xfdb/50145

External Source: VUPEN

Name: ADV-2009-1317

Hyperlink:http://www.vupen.com/english/advisories/2009/1317

External Source: VUPEN

Name: ADV-2009-1189

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2009/1189

External Source: SECTRACK

Name: 1022139

Hyperlink:http://www.securitytracker.com/id?1022139

External Source: BID

Name: 34736

Hyperlink:http://www.securityfocus.com/bid/34736

External Source: REDHAT

Name: RHSA-2009:0478

Hyperlink:http://www.redhat.com/support/errata/RHSA-2009-0478.html

External Source: MILW0RM

Name: 8569

Hyperlink:http://www.milw0rm.com/exploits/8569

External Source: CONFIRM

Name: http://www.adobe.com/support/security/bulletins/apsb09-06.html

Hyperlink:http://www.adobe.com/support/security/bulletins/apsb09-06.html

External Source: CONFIRM

Name: http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=926953

Hyperlink:http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=926953

External Source: SUNALERT

Name: 259028

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-66-259028-1

External Source: GENTOO

Name: GLSA-200907-06

Hyperlink:http://security.gentoo.org/glsa/glsa-200907-06.xml

External Source: SECUNIA

Name: 35734

Hyperlink:http://secunia.com/advisories/35734

External Source: SECUNIA

Name: 35416

Hyperlink:http://secunia.com/advisories/35416

External Source: SECUNIA

Name: 35358

Hyperlink:http://secunia.com/advisories/35358

External Source: SECUNIA

Name: 35152

Hyperlink:http://secunia.com/advisories/35152

External Source: SECUNIA

Name: 35096

Hyperlink:http://secunia.com/advisories/35096

External Source: SECUNIA

Name: 35055

Hyperlink:http://secunia.com/advisories/35055

External Source: SECUNIA

Name: 34924

Type: Advisory

Hyperlink:http://secunia.com/advisories/34924

External Source: MISC

Name: http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txt

Hyperlink:http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txt

External Source: OSVDB

Name: 54130

Hyperlink:http://osvdb.org/54130

External Source: SUSE

Name: SUSE-SR:2009:011

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html

External Source: SUSE

Name: SUSE-SA:2009:027

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00001.html

External Source: CONFIRM

Name: http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.html

Hyperlink:http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.html

External Source: CONFIRM

Name: http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html

Type: Advisory

Hyperlink:http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html

External Source: MISC

Name: http://blogs.adobe.com/psirt/2009/04/potential_adobe_reader_issue.html

Type: Advisory

Hyperlink:http://blogs.adobe.com/psirt/2009/04/potential_adobe_reader_issue.html