The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Adobe Reader and Acrobat ActiveX Control Remote Code Execution
Vulnerabilities
------------------------------------------------------------------------
SUMMARY
Multiple vulnerabilities have been identified in Adobe Reader and Acrobat,
which could be exploited by attackers to take complete control of an
affected system.
DETAILS
Vulnerable Systems:
* Adobe Reader versions 7.0.0 through 7.0.8
* Adobe Acrobat Standard versions 7.0.0 through 7.0.8
* Adobe Acrobat Professional versions 7.0.0 through 7.0.8
Immune Systems:
* Adobe Reader versions 8.0.0
These flaws are due to memory corruption errors in the AcroPDF ActiveX
control (AcroPDF.dll) that does not properly handle malformed arguments
passed to the "setPageMode()", "setLayoutMode()", "setNamedDest()", and
"LoadFile()" methods, which could be exploited by remote attackers to
execute arbitrary commands by tricking a user into visiting a specially
crafted web page with Internet Explorer.
Solution:
Upgrade to Adobe Reader 8:
<http://www.adobe.com/products/acrobat/readstep2.html>
http://www.adobe.com/products/acrobat/readstep2.html
Additional Information:
Additional details can be found at:
<http://www.adobe.com/support/security/advisories/apsa06-02.html>
http://www.adobe.com/support/security/advisories/apsa06-02.html and
<http://www.adobe.com/support/security/bulletins/apsb06-20.html>
http://www.adobe.com/support/security/bulletins/apsb06-20.html
ADDITIONAL INFORMATION
The information has been provided by FrSIRT.
The original article can be found at:
<http://www.frsirt.com/english/advisories/2006/4751>
http://www.frsirt.com/english/advisories/2006/4751
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
