CVE-2009-3953
published 2010-01-13CVE-2009-3953: The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to…
PriorityP187high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-06-22
Exploited in the wild
EPSS
83.86%
99.7th percentile
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | acrobat | >= 7.0 < 7.1.4 | 7.1.4 |
| adobe | acrobat | >= 8.0 < 8.2 | 8.2 |
| adobe | acrobat | >= 9.0 < 9.3 | 9.3 |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| suse | linux_enterprise | — | — |
| suse | linux_enterprise_debuginfo | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Malicious PDF containing malformed U3D (Universal 3D) stream data targeting CLODProgressiveMeshDeclaration array overflow; inspect PDF streams for embedded U3D objects with anomalous CLODProgressiveMeshDeclaration block sizes. ↗
- →Exploit uses JavaScript heap spray (PREPAREHOLES + PREPAREMEMORY) embedded in the PDF; detect suspicious JavaScript inside PDF with heap-spray patterns (large repeated NOP sleds followed by shellcode) targeting Adobe Reader processes. ↗
- →The exploit sets EXITFUNC to 'process', meaning the spawned process will terminate after shellcode execution; monitor for Adobe Reader child processes that exit abnormally or spawn unexpected child processes. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck8.8HIGH
cisa8.8HIGH
vendor_redhat9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
cisa·2022-06-08·CVSS 8.8
CVE-2009-3953 [HIGH] CWE-119 Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
Vulnerability: Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
Affected: Adobe Acrobat and Reader
Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2009-3953
Remediation Due Date: 2022-06-22
Red Hat
acroread: multiple code execution flaws (APSB10-02)
vendor_redhat·2010-01-12·CVSS 9.3
CVE-2009-3953 [CRITICAL] acroread: multiple code execution flaws (APSB10-02)
acroread: multiple code execution flaws (APSB10-02)
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
GHSA
GHSA-q4f6-24ph-r6rm: The U3D implementation in Adobe Reader and Acrobat 9
ghsa_unreviewed·2022-05-02·CVSS 9.3
CVE-2009-3953 [CRITICAL] CWE-119 GHSA-q4f6-24ph-r6rm: The U3D implementation in Adobe Reader and Acrobat 9
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
VulnCheck
Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
vulncheck·2009·CVSS 8.8
CVE-2009-3953 [HIGH] CWE-119 Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.
Affected: Adobe Acrobat and Reader
Required Action: Apply updates per vendor instructions.
Exploitation References: https://cisa.gov/news-events/alerts/2015/04/29/top-30-targeted-high-risk-vulnerabilities; https://www.us-cert.gov/ncas/alerts/TA15-119A; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-06-22
No detection rules found.
Exploit-DB
Adobe - U3D CLODProgressiveMeshDeclaration Array Overrun (Metasploit) (2)
exploitdb·2010-09-25
CVE-2009-3953 Adobe - U3D CLODProgressiveMeshDeclaration Array Overrun (Metasploit) (2)
Adobe - U3D CLODProgressiveMeshDeclaration Array Overrun (Metasploit) (2)
---
##
# $Id: adobe_u3d_meshdecl.rb 10477 2010-09-25 11:59:02Z mc $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
require 'zlib'
class Metasploit3 'Adobe U3D CLODProgressiveMeshDeclaration Array Overrun',
'Description' => %q{
This module exploits an array overflow in Adobe Reader and Adobe Acrobat.
Affected versions include MSF_LICENSE,
'Author' =>
[
'Felipe Andres Manzano ',
'jduck'
],
'Version' => '$Revision: 10477 $',
'References' =>
[
[ 'CVE', '2009-3953' ],
[ 'OSVDB', '61690' ],
Metasploit
Adobe U3D CLODProgressiveMeshDeclaration Array Overrun
metasploit
Adobe U3D CLODProgressiveMeshDeclaration Array Overrun
Adobe U3D CLODProgressiveMeshDeclaration Array Overrun
This module exploits an array overflow in Adobe Reader and Adobe Acrobat. Affected versions include < 7.1.4, < 8.2, and < 9.3. By creating a specially crafted pdf that a contains malformed U3D data, an attacker may be able to execute arbitrary code.
Qualys
US-CERT: Top 30 Vulnerabilities | Qualys
blogs_qualys·2015-05-01·CVSS 2.6
[LOW] US-CERT: Top 30 Vulnerabilities | Qualys
On April 29, 2015 US-CERT published TA15-119A which describes the Top 30 vulnerabilities that critical infrastructure organizations should focus on because they are under attack all the time. The list contains Windows, Internet Explorer, Adobe Software from Reader, Flash to Cold Fusion, Java from Oracle and others and is quite similar to the more generic set of software packages published by the German BSI last December.
Here is a list of the vulnerabilities in the advisory. I have reordered and optimized where possible for efficient scanning with Qualys, for example listing the most recent patch first to take advantage of superseding patches:
- Windows: MS14-060 for CVE-2014-4114, Qualys ID: 90979
- Internet Explorer: MS14-021 for CVE-2014-1776, Qualys ID: 100191
- MS14-012 for CVE-201
Qualys
US-CERT: Top 30 Vulnerabilities | Qualys
blogs_qualys·2015-05-01·CVSS 2.6
[LOW] US-CERT: Top 30 Vulnerabilities | Qualys
On April 29, 2015 US-CERT published TA15-119A which describes the Top 30 vulnerabilities that critical infrastructure organizations should focus on because they are under attack all the time. The list contains Windows, Internet Explorer, Adobe Software from Reader, Flash to Cold Fusion, Java from Oracle and others and is quite similar to the more generic set of software packages published by the German BSI last December.
Here is a list of the vulnerabilities in the advisory. I have reordered and optimized where possible for efficient scanning with Qualys, for example listing the most recent patch first to take advantage of superseding patches:
Windows: MS14-060 for CVE-2014-4114, Qualys ID: 90979
MS14-012 for CVE-2014-0322
MS13-038 for CVE-2013-1347
MS13-008 for CVE-2012-4792
MS10-01
Bugzilla
CVE-2009-3953 CVE-2009-3954 CVE-2009-3955 CVE-2009-3959 acroread: multiple code execution flaws (APSB10-02)
bugzilla·2010-01-11·CVSS 8.8
CVE-2009-3953 [HIGH] CVE-2009-3953 CVE-2009-3954 CVE-2009-3955 CVE-2009-3959 acroread: multiple code execution flaws (APSB10-02)
CVE-2009-3953 CVE-2009-3954 CVE-2009-3955 CVE-2009-3959 acroread: multiple code execution flaws (APSB10-02)
Adobe Security Bulletin for Adobe Reader and Acrobat APSB10-02 fixes following code execution flaws:
This update resolves a use-after-free vulnerability in Multimedia.api that could lead to code execution (CVE-2009-4324).
-> tracked via separate bug #547799
This update resolves an array boundary issue in U3D support that could lead to code execution (CVE-2009-3953).
This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2009-3955).
This update resolves an integer overflow vulnerability in U3D support that could lead to code execution (CVE-2009-3959).
Discussion:
Two more platform-specific issues:
This update resolves a DLL-loading vulner
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.htmlhttp://osvdb.org/61690http://secunia.com/advisories/38138http://secunia.com/advisories/38215http://www.adobe.com/support/security/bulletins/apsb10-02.htmlhttp://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdeclhttp://www.redhat.com/support/errata/RHSA-2010-0060.htmlhttp://www.securityfocus.com/bid/37758http://www.securitytracker.com/id?1023446http://www.us-cert.gov/cas/techalerts/TA10-013A.htmlhttp://www.vupen.com/english/advisories/2010/0103https://bugzilla.redhat.com/show_bug.cgi?id=554293https://exchange.xforce.ibmcloud.com/vulnerabilities/55551https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.htmlhttp://osvdb.org/61690http://secunia.com/advisories/38138http://secunia.com/advisories/38215http://www.adobe.com/support/security/bulletins/apsb10-02.htmlhttp://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdeclhttp://www.redhat.com/support/errata/RHSA-2010-0060.htmlhttp://www.securityfocus.com/bid/37758http://www.securitytracker.com/id?1023446http://www.us-cert.gov/cas/techalerts/TA10-013A.htmlhttp://www.vupen.com/english/advisories/2010/0103https://bugzilla.redhat.com/show_bug.cgi?id=554293https://exchange.xforce.ibmcloud.com/vulnerabilities/55551https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953
2010-01-13
Published
2022-06-08
Added to CISA KEV
Exploited in the wild