Test ID:	1.3.6.1.4.1.25623.1.0.901096
Category:	Buffer overflow
Title:	Adobe Reader/Acrobat Multimedia Doc.media.newPlayer Code Execution Vulnerability - Windows
Summary:	Adobe Reader/Acrobat is prone to Doc.media.newPlayer Remote Code Execution vulnerability.
Description:	Summary: Adobe Reader/Acrobat is prone to Doc.media.newPlayer Remote Code Execution vulnerability. Vulnerability Insight: There exists a flaw in the JavaScript module doc.media object while sending a null argument to the newPlayer() method as the exploitation method makes use of a vpointer that has not been initialized. Vulnerability Impact: Successful exploitation will let attackers to execute arbitrary code and compromise a user's system. Affected Software/OS: Adobe Acrobat version 9.2.0 and prior. Adobe Acrobat version 9.2.0 and prior. Solution: Upgrade Adobe Reader version 9.3.2 or later. Workaround: Disable JavaScript execution from the Adobe Acrobat/Reader product configuration menu settings. CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-4324 BugTraq ID: 37331 http://www.securityfocus.com/bid/37331 Cert/CC Advisory: TA10-013A http://www.us-cert.gov/cas/techalerts/TA10-013A.html CERT/CC vulnerability note: VU#508357 http://www.kb.cert.org/vuls/id/508357 http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html http://www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rb http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214 http://www.symantec.com/connect/blogs/zero-day-xmas-present http://osvdb.org/60980 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795 http://www.redhat.com/support/errata/RHSA-2010-0060.html http://secunia.com/advisories/37690 http://secunia.com/advisories/38138 http://secunia.com/advisories/38215 SuSE Security Announcement: SUSE-SA:2010:008 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html http://www.vupen.com/english/advisories/2009/3518 http://www.vupen.com/english/advisories/2010/0103 XForce ISS Database: acro-reader-unspecifed-code-execution(54747) https://exchange.xforce.ibmcloud.com/vulnerabilities/54747
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.