Release date: June 23, 2008

Vulnerability identifier: APSB08-15

CVE number: CVE-2008-2641

Platform: All platforms

Affected software versions:

• Adobe Reader 8.0 through 8.1.2
• Adobe Reader 7.0.9 and earlier
• Adobe Acrobat Professional, 3D and Standard 8.0 through 8.1.2
• Adobe Acrobat Professional, 3D and Standard 7.0.9 and earlier

NOTE: Adobe Reader 7.1.0 and Acrobat 7.1.0 are not vulnerable to this issue. Adobe Reader 9 and Acrobat 9, expected to be available by July 2008, are also not vulnerable to this issue...

Summary

A critical vulnerability has been identified in Adobe Reader and Acrobat 8.1.2. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system.

Adobe recommends users of Acrobat 8 and Adobe Reader install the 8.1.2 Security Update 1 patch.

Adobe recommends Adobe Reader 8 users update to Adobe Reader 8.1.2 Security Update 1, available at the links below:

For Windows: http://www.adobe.com/support/downloads/detail.jsp?ftpID=3967

For Macintosh: http://www.adobe.com/support/downloads/detail.jsp?ftpID=3966

Adobe recommends Acrobat 8 users on Windows update to Acrobat 8.1.2 Security Update 1, available here: http://www.adobe.com/support/downloads/detail.jsp?ftpID=3976

Adobe recommends Acrobat 8 users on Macintosh update to Acrobat 8.1.2 Security Update 1, available here: http://www.adobe.com/support/downloads/detail.jsp?ftpID=3977

Adobe recommends Acrobat 3D Version 8 users on Windows update to Acrobat 3D Version 8.1.2 Security Update 1, available here: http://www.adobe.com/support/downloads/detail.jsp?ftpID=3975

Users with Adobe Reader 7.0 through 7.0.9 should upgrade to Adobe Reader 7.1.0: http://www.adobe.com/go/getreader.

Adobe recommends Acrobat 7 users on Windows update to Acrobat 7.1.0, available here: http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows

Adobe recommends Acrobat 7 users on Macintosh update to Acrobat 7.1.0, available here: http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh

Adobe categorizes this as an critical issue and recommends affected users update their installations.

A critical vulnerability has been identified in Adobe Reader and Acrobat 8.1.2 and earlier versions. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system.

Adobe recommends users of Acrobat and Adobe Reader update their product installations using the instructions above to protect themselves from potential vulnerabilities. Adobe Reader 7.1.0 and Acrobat 7.1.0 are not vulnerable to this issue.

This update resolves an input validation issue in a JavaScript method that could potentially lead to remote code execution. (CVE-2008-2641)

NOTE: there are reports that this issue is being exploited in the wild.

Adobe would like to thank the Information Security Team of the Johns Hopkins University Applied Physics Laboratory for reporting the relevant issue and for working with Adobe to help protect our customers' security.

http://www.adobe.com/support/security/bulletins/apsb08-15.html

Comments Index (Total Messages: 0)

Post Reply
Name:	Guest
Title:
Comment:
Enter this security word

Powered by a Zone-H(ified) version of AkoComment 3.0!