Adobe Reader / Acrobat Multiple Vulnerabilities
Release Date : 2013-01-09
Criticality level : Highly critical
Impact : Security Bypass
Privilege escalation
System access
Where : From remote
Solution Status : Vendor Patch
Software: Adobe Acrobat 9.x
Adobe Acrobat X 10.x
Adobe Acrobat XI 11.x
Adobe Reader 9.x
Adobe Reader X 10.x
Adobe Reader XI 11.x
Description:
Multiple vulnerabilities have been reported in Adobe Reader and Adobe Acrobat, which can be exploited by malicious, local users to gain escalated privileges and by malicious people to bypass certain security restrictions and compromise a user's system.
1) An unspecified error can be exploited to corrupt memory.
2) Some unspecified errors can be exploited to corrupt memory.
3) Another unspecified error can be exploited to corrupt memory.
4) A use-after-free error can be exploited to dereference already freed memory.
5) An unspecified error can be exploited to cause a heap-based buffer overflow.
6) Another unspecified error can be exploited to cause a heap-based buffer overflow.
7) An unspecified error can be exploited to cause a stack-based buffer overflow.
8) Another unspecified error can be exploited to cause a stack-based buffer overflow.
9) Some unspecified errors can be exploited to cause buffer overflows.
10) Some integer overflow errors can be exploited to corrupt memory.
11) An unspecified error can be exploited to gain escalated privileges.
12) Some unspecified logic errors can be exploited to execute arbitrary code.
13) An unspecified error can be exploited to bypass certain security restrictions.
14) Another unspecified error can be exploited to bypass certain security restrictions.
Successful exploitation of vulnerabilities #1 through #10 and #12 may allow execution of arbitrary code.
The vulnerabilities are reported in the following products:
* Adobe Reader XI and Acrobat XI version 11.0.0 for Windows and Macintosh.
* Adobe Reader X and Acrobat X versions 10.1.4 and prior for Windows and Macintosh.
* Adobe Reader and Acrobat versions 9.5.2 and prior for Windows and Macintosh.
* Adobe Reader for Linux versions 9.5.1 and prior.
Solution:
Update to a fixed version.
Provided and/or discovered by:
1) The vendor credits Nicolas Gregoire via iDefense Labs
2, 4, 7, 9, 10, 12) The vendor credits Mateusz Jurczyk and Gynvael Coldwind, Google Security Team
3) The vendor independently credits David D. Rude II, iDefense Labs and Alexander Gavrun via iDefense Labs
5) The vendor credits Tom Gallagher, Microsoft and Microsoft Vulnerability Research
6) The vendor credits Alexander Gavrun via iDefense Labs
8) Reported by the vendor
11) The vendor independently credits Myke Hamada, Joost Bakker, Anand Bhat, and Timothy McKenzie
13) The vendor credits Joel Geraci, Practical:PDF
14) The vendor independently credits Billy Rios, Federico Lanusse, and Mauro Gentile
Original Advisory:
Adobe (APSB13-02):
http://www.adobe.com/support/security/bulletins/apsb13-02.html
http://secunia.com/advisories/51791/
Was this reply helpful? (0) (0)
Staff pick
Manage updates with the Download App
- 1/10/13 6:36 AM 
Unread
Read
Locked thread
Moderator
CNET Staff
Samsung Staff
Norton Authorized Support Team
AVG Staff
avast! Staff
Webroot Support Team
Acer Customer Experience Team
Windows Outreach Team
Dell Staff
Intel Staff
Question
Resolved question
General discussion
Tip
Alert or warning
Praise
Rant