Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2009-2564 — Adobe Acrobat Reader vulnerability

CWE-2646 documents5 sources
Severity
7.2HIGHNVD
EPSS
0.3%
top 49.12%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Adobe Acrobat ReaderCorel Getplus Download ManagerNOS Microsystems Getplus Download Manager
Timeline
PublishedJul 21
Latest updateMay 2

Description

NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of t…

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages3 packages

▶NVDadobe/acrobat_reader9.0, 9.1+1

🔴Vulnerability Details

2
GHSA
GHSA-9x38-fqhc-vfhf: NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1↗2022-05-02
▶
CVEList
CVE-2009-2564: NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1↗2009-07-21
▶

💥Exploits & PoCs

2
Exploit-DB
Adobe Acrobat 9.1.2 NOS - Local Privilege Escalation↗2009-07-21
▶
Exploit-DB
Adobe 9.x Related Service - 'getPlus_HelperSvc.exe' Local Privilege Escalation↗2009-07-20
▶

💬Community

1
Bugzilla
acroread: Multiple arbitrary code execution fixes in 8.1.7 (APSB09-15)↗2009-10-13
▶
CVE-2009-2564 — Adobe Acrobat Reader vulnerability | cvebase