// For flags

CVE-2009-1492

Adobe Reader 8.1.4/9.1 - 'GetAnnots()' Remote Code Execution

Severity Score

9.3
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

3
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that contains an annotation, and has an OpenAction entry with JavaScript code that calls this method with crafted integer arguments.

El método getAnnots Doc en la API de JavaScript en Adobe Reader y Acrobat v9.1, v8.1.4, v7.1.1 y anteriores permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria) o ejecutar código arbitrario a través de un archivo PDF que contiene una anotación, y tiene una entrada OpenAction con el código JavaScript que llama a este método con argumentos enteros elaborados.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2009-04-30 CVE Reserved
  • 2009-04-30 CVE Published
  • 2024-05-13 EPSS Updated
  • 2024-08-07 CVE Updated
  • 2024-08-07 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-399: Resource Management Errors
CAPEC
References (29)
URL Tag Source
http://osvdb.org/54130 Broken Link
http://secunia.com/advisories/34924 Third Party Advisory
http://secunia.com/advisories/35055 Third Party Advisory
http://secunia.com/advisories/35096 Third Party Advisory
http://secunia.com/advisories/35152 Third Party Advisory
http://secunia.com/advisories/35358 Third Party Advisory
http://secunia.com/advisories/35416 Third Party Advisory
http://secunia.com/advisories/35734 Third Party Advisory
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=926953 Third Party Advisory
http://www.kb.cert.org/vuls/id/970180 Third Party Advisory
http://www.securitytracker.com/id?1022139 Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA09-133B.html Third Party Advisory
http://www.vupen.com/english/advisories/2009/1189 Third Party Advisory
http://www.vupen.com/english/advisories/2009/1317 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50145 Third Party Advisory
URL Date SRC
https://www.exploit-db.com/exploits/8569 2024-08-07
http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txt 2024-08-07
http://www.securityfocus.com/bid/34736 2024-08-07
URL Date SRC
URL Date SRC
http://blogs.adobe.com/psirt/2009/04/potential_adobe_reader_issue.html 2018-11-08
http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html 2018-11-08
http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.html 2018-11-08
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00001.html 2018-11-08
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html 2018-11-08
http://security.gentoo.org/glsa/glsa-200907-06.xml 2018-11-08
http://sunsolve.sun.com/search/document.do?assetkey=1-66-259028-1 2018-11-08
http://www.adobe.com/support/security/bulletins/apsb09-06.html 2018-11-08
http://www.redhat.com/support/errata/RHSA-2009-0478.html 2018-11-08
https://access.redhat.com/security/cve/CVE-2009-1492 2009-05-13
https://bugzilla.redhat.com/show_bug.cgi?id=498322 2009-05-13
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Adobe
Search vendor "Adobe"
 Acrobat
Search vendor "Adobe" for product "Acrobat"
 >= 7.0 <= 7.1.1
Search vendor "Adobe" for product "Acrobat" and version " >= 7.0 <= 7.1.1"
-
Affected
Adobe
Search vendor "Adobe"
 Acrobat
Search vendor "Adobe" for product "Acrobat"
 >= 8.0 <= 8.1.4
Search vendor "Adobe" for product "Acrobat" and version " >= 8.0 <= 8.1.4"
-
Affected
Adobe
Search vendor "Adobe"
 Acrobat
Search vendor "Adobe" for product "Acrobat"
 >= 9.0 <= 9.1
Search vendor "Adobe" for product "Acrobat" and version " >= 9.0 <= 9.1"
-
Affected
Adobe
Search vendor "Adobe"
 Acrobat Reader
Search vendor "Adobe" for product "Acrobat Reader"
 >= 7.0 <= 7.1.1
Search vendor "Adobe" for product "Acrobat Reader" and version " >= 7.0 <= 7.1.1"
-
Affected
Adobe
Search vendor "Adobe"
 Acrobat Reader
Search vendor "Adobe" for product "Acrobat Reader"
 >= 8.0 <= 8.1.4
Search vendor "Adobe" for product "Acrobat Reader" and version " >= 8.0 <= 8.1.4"
-
Affected
Adobe
Search vendor "Adobe"
 Acrobat Reader
Search vendor "Adobe" for product "Acrobat Reader"
 >= 9.0 <= 9.1
Search vendor "Adobe" for product "Acrobat Reader" and version " >= 9.0 <= 9.1"
-
Affected