Adobe Reader < 7.1.0 / 8.1.2 SU1 Unspecified JavaScript Method Handling Arbitrary Code Execution

high Nessus Plugin ID 33256

Synopsis

The remote Windows host contains an application that allows remote code execution.

Description

The version of Adobe Reader installed on the remote Windows host contains a flaw in the function Collab.collectEmailInfo() that could allow a remote attacker to crash the application and/or to take control of the affected system.

To exploit this flaw, an attacker would need to trick a user on the affected system into opening a specially crafted PDF file.

Solution

- If running 7.x, upgrade to version 7.1.0 or later.

- If running 8.x, upgrade to 8.1.2, if necessary, and then apply Adobe's Security Update 1 for 8.1.2.

Plugin Details

Severity: High

ID: 33256

File Name: adobe_reader_812_su1.nasl

Version: 1.21

Type: local

Agent: windows

Family: Windows

Published: 6/25/2008

Updated: 11/15/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:adobe:acrobat_reader

Required KB Items: SMB/Acroread/Version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/23/2008

Reference Information

CVE: CVE-2008-2641

BID: 29908

Secunia: 30832

Detections

Analytics