Adobe Reader and Acrobat 'newplayer()' JavaScript Method Remote Code Execution Vulnerability

Publish date: July 21, 2015

Severity: CRITICAL

CVE Identifier: CVE-2009-4324

Advisory Date: DEC 17, 2009

DESCRIPTION

Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

TREND MICRO PROTECTION INFORMATION

Apply associated Trend Micro DPI Rules.

SOLUTION

Trend Micro Deep Security DPI Rule Number: 1004008

Trend Micro Deep Security DPI Rule Name: 1004008 - Adobe Reader And Acrobat 'newplayer()' JavaScript Method Code Execution

AFFECTED SOFTWARE AND VERSION

Adobe Acrobat 6.0
Adobe Acrobat 6.0.1
Adobe Acrobat 6.0.2
Adobe Acrobat 6.0.3
Adobe Acrobat 6.0.4
Adobe Acrobat 6.0.5
Adobe Acrobat 7.0
Adobe Acrobat 7.0.1
Adobe Acrobat 7.0.2
Adobe Acrobat 7.0.3
Adobe Acrobat 7.0.4
Adobe Acrobat 7.0.5
Adobe Acrobat 7.0.6
Adobe Acrobat 7.0.7
Adobe Acrobat 7.0.8
Adobe Acrobat 7.0.9
Adobe Acrobat 8.0.0
Adobe Acrobat 8.1
Adobe Acrobat 8.1.1
Adobe Acrobat 8.1.2
Adobe Acrobat Reader 3.0
Adobe Acrobat Reader 4.0
Adobe Acrobat Reader 4.0.5
Adobe Acrobat Reader 4.0.5a
Adobe Acrobat Reader 4.0.5c
Adobe Acrobat Reader 4.5
Adobe Acrobat Reader 5.0
Adobe Acrobat Reader 5.0.10
Adobe Acrobat Reader 5.0.11
Adobe Acrobat Reader 5.0.5
Adobe Acrobat Reader 5.0.6
Adobe Acrobat Reader 5.0.7
Adobe Acrobat Reader 5.0.9
Adobe Acrobat Reader 5.1
Adobe Acrobat Reader 6.0
Adobe Acrobat Reader 6.0.1
Adobe Acrobat Reader 6.0.2
Adobe Acrobat Reader 6.0.3
Adobe Acrobat Reader 6.0.4
Adobe Acrobat Reader 6.0.5
Adobe Acrobat Reader 7.0
Adobe Acrobat Reader 7.0.1
Adobe Acrobat Reader 7.0.2
Adobe Acrobat Reader 7.0.3
Adobe Acrobat Reader 7.0.4
Adobe Acrobat Reader 7.0.5
Adobe Acrobat Reader 7.0.6
Adobe Acrobat Reader 7.0.7
Adobe Acrobat Reader 7.0.8
Adobe Acrobat Reader 7.0.9
Adobe Acrobat Reader 8.0
Adobe Acrobat Reader 8.1
Adobe Acrobat Reader 8.1.1
Adobe Acrobat Reader 8.1.2
Adobe Acrobat Reader 9.0
Adobe Acrobat Reader 9.1
Adobe Acrobat Reader 9.2

Related Vulnerability

Adobe Multiple Products PDF JavaScript Method Buffer Overflow

Related Malware

Featured Stories

View All

$hacker machine interface$
The State of SCADA HMI Vulnerabilities
A complete discussion of the different vulnerability categories, including case studies of vulnerable SCADA HMIs. The paper also provides a guide for vulnerability researchers, as well as vendors on quick and efficient bug discovery.
Read more
Rogue Robots: Testing the Limits of an Industrial Robot’s Security
The modern world relies heavily on industrial robots. But is the current robotics ecosystem secure enough to withstand a cyber attack?
Read more
$two years of pawn storm$
From Espionage to Cyber Propaganda: Pawn Storm's Activities over the Past Two Years
This paper takes a look at Pawn Storm's operations within the last two years, and how the group has expanded their activities from espionage to the use of cyber propaganda tactics.
Read more
$securing home routers$
Securing Your Routers Against Mirai and Other Home Network Attacks
Cybercriminals can turn unsecure home routers into slaves for their botnets or even abuse them to steal banking credentials. Know about your router’s hidden weaknesses and the many ways you can defend your homes and businesses against these threats.
Read more