Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability

Summary

Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.

Remediation

1. Inventory every Adobe Acrobat and Reader deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.
3. Review logs from before the change for signs of exploitation.

References

• Advisoryhttps://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities
• Advisoryhttps://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports
• Advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2009-3459
• Referencehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534
• Referencehttps://exchange.xforce.ibmcloud.com/vulnerabilities/53691
• Referencehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3459