Vulnerability Description
The JavaScript for Acrobat API in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 does not properly implement the (1) Privileged Context and (2) Safe Path restrictions for unspecified JavaScript methods, which allows remote attackers to create arbitrary files, and possibly execute arbitrary code, via the cPath parameter in a crafted PDF file. NOTE: some of these details are obtained from third party information.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Acrobat | <= 9.1.3 |
| Adobe | Acrobat Reader | <= 9.1.3 |
Related Weaknesses (CWE)
References
- http://securitytracker.com/id?1023007
- http://www.adobe.com/support/security/bulletins/apsb09-15.htmlPatchVendor Advisory
- http://www.kb.cert.org/vuls/id/257117PatchUS Government Resource
- http://www.securityfocus.com/bid/36638
- http://www.securityfocus.com/bid/36664
- http://www.us-cert.gov/cas/techalerts/TA09-286B.htmlPatchUS Government Resource
- http://www.vupen.com/english/advisories/2009/2898PatchVendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
- http://securitytracker.com/id?1023007
- http://www.adobe.com/support/security/bulletins/apsb09-15.htmlPatchVendor Advisory
- http://www.kb.cert.org/vuls/id/257117PatchUS Government Resource
- http://www.securityfocus.com/bid/36638
- http://www.securityfocus.com/bid/36664
- http://www.us-cert.gov/cas/techalerts/TA09-286B.htmlPatchUS Government Resource
- http://www.vupen.com/english/advisories/2009/2898PatchVendor Advisory
FAQ
What is CVE-2009-2993?
CVE-2009-2993 is a vulnerability with a CVSS score of 9.3 (HIGH). The JavaScript for Acrobat API in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 does not properly implement the (1) Privileged Context and (2) Safe Path restrictions ...
How severe is CVE-2009-2993?
CVE-2009-2993 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2009-2993?
Check the references section above for vendor advisories and patch information. Affected products include: Adobe Acrobat, Adobe Acrobat Reader.