Security Intelligence Operations

Adobe Reader and Acrobat versions 9.1, 8.1.4, and 7.1.1 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the user.

The vulnerability is due to insufficient boundary checking on annotation parameters in Adobe PDF documents. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to view a malicious PDF. If the user views the document, the attacker could execute arbitrary code with the privileges of the user.

Proof-of-concept code is available.

Adobe has confirmed this vulnerability and released updated software.

Adobe Reader and Acrobat versions 9.1, 8.1.4, and 7.1.1 and prior are vulnerable.

To exploit the vulnerability, an attacker must convince a user to view a malicious PDF. The attacker may provide a file to the user as part of an e-mail message or host the file on a website. The attacker may use social engineering techniques to make users more likely to open a provided document.

An exploit could allow the attacker to perform actions or execute code on the system with the privileges of the user. If users on affected systems run applications with restricted privileges, the impact of an exploit may be limited. However, if a user holds elevated privileges, the attacker could execute arbitrary code that may result in complete system compromise.

Exploit code is available that allows an attacker to execute arbitrary code that creates a remote shell on Linux platforms. Information from Adobe indicates the vulnerability may also affect applications that are running on Microsoft Windows platforms; however, no exploit code that exploits the vulnerability in Adobe Acrobat for Windows is known to exist publicly.

Adobe has released a security bulletin at the following link: APSB09-06

Red Hat has released a security advisory at the following link: RHSA-2009-0478

Sun has re-released an alert notification at the following link: 259028

US-CERT has released a vulnerability note at the following link: VU#970180