ID de Prueba:	1.3.6.1.4.1.25623.1.0.901096
Categoría:	Buffer overflow
Título:	Adobe Reader/Acrobat Multimedia Doc.media.newPlayer Code Execution Vulnerability - Windows
Resumen:	Adobe Reader/Acrobat is prone to Doc.media.newPlayer Remote Code Execution vulnerability.
Descripción:	Summary: Adobe Reader/Acrobat is prone to Doc.media.newPlayer Remote Code Execution vulnerability. Vulnerability Insight: There exists a flaw in the JavaScript module doc.media object while sending a null argument to the newPlayer() method as the exploitation method makes use of a vpointer that has not been initialized. Vulnerability Impact: Successful exploitation will let attackers to execute arbitrary code and compromise a user's system. Affected Software/OS: Adobe Acrobat version 9.2.0 and prior. Adobe Acrobat version 9.2.0 and prior. Solution: Upgrade Adobe Reader version 9.3.2 or later. Workaround: Disable JavaScript execution from the Adobe Acrobat/Reader product configuration menu settings. CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2009-4324 BugTraq ID: 37331 http://www.securityfocus.com/bid/37331 Cert/CC Advisory: TA10-013A http://www.us-cert.gov/cas/techalerts/TA10-013A.html CERT/CC vulnerability note: VU#508357 http://www.kb.cert.org/vuls/id/508357 http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html http://www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rb http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214 http://www.symantec.com/connect/blogs/zero-day-xmas-present http://osvdb.org/60980 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795 http://www.redhat.com/support/errata/RHSA-2010-0060.html http://secunia.com/advisories/37690 http://secunia.com/advisories/38138 http://secunia.com/advisories/38215 SuSE Security Announcement: SUSE-SA:2010:008 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html http://www.vupen.com/english/advisories/2009/3518 http://www.vupen.com/english/advisories/2010/0103 XForce ISS Database: acro-reader-unspecifed-code-execution(54747) https://exchange.xforce.ibmcloud.com/vulnerabilities/54747
Copyright	Copyright (C) 2009 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.