CERTA-2000-AVI-020
Vulnerability from certfr_avis - Published: - Updated:
Tous les produits Acrobat sous Windows sont vulnérables lors de la lecture d'un fichier PDF malformé. Au mieux l'application s'arrête, au pire du code arbitraire est exécuté sur la machine.
Description
Le format PDF est un format de lecture de document très répandu. Les logiciels de la famille Acrobat permettent de manipuler les documents PDF. Acrobat est vulnérable à un débordement de pile. Dès lors un utilisateur malveillant peut construire un document PDF qui, lors de sa visualisation, stoppe l'application ou exécute du code.
Solution
Correctif pour Acrobat 4.05, Acrobat Reader 4.05, Acrobat Businnes Tools 4.05 et Acrobat Fill In :
ftp://ftp.adobe.com/pub/adobe/win/4.x/ac405up2.exe
En cas de consultation d'un site internet proposant un fichier PDF, enregistrer le fichier concerné afin de l'ouvrir avec la version corrigée d'Acrobat.
None| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Acrobat Fill In ;",
"product": {
"name": "Acrobat",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Adobe Acrobat Reader 4.05 pour Windows ;",
"product": {
"name": "Acrobat",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Adobe Acrobat Business Tools 4.05 ;",
"product": {
"name": "Acrobat",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Plugin Acrobat pour navigateur Web (Netscape, Internet Explorer).",
"product": {
"name": "Acrobat",
"vendor": {
"name": "Adobe",
"scada": false
}
}
},
{
"description": "Adobe Acrobat 4.05 pour Windows ;",
"product": {
"name": "Acrobat",
"vendor": {
"name": "Adobe",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Description\n\nLe format PDF est un format de lecture de document tr\u00e8s r\u00e9pandu. Les\nlogiciels de la famille Acrobat permettent de manipuler les documents\nPDF. Acrobat est vuln\u00e9rable \u00e0 un d\u00e9bordement de pile. D\u00e8s lors un\nutilisateur malveillant peut construire un document PDF qui, lors de sa\nvisualisation, stoppe l\u0027application ou ex\u00e9cute du code.\n\n## Solution\n\nCorrectif pour Acrobat 4.05, Acrobat Reader 4.05, Acrobat Businnes Tools\n4.05 et Acrobat Fill In :\n\n ftp://ftp.adobe.com/pub/adobe/win/4.x/ac405up2.exe\n\n \n \n\nEn cas de consultation d\u0027un site internet proposant un fichier PDF,\nenregistrer le fichier concern\u00e9 afin de l\u0027ouvrir avec la version\ncorrig\u00e9e d\u0027Acrobat.\n",
"cves": [],
"links": [],
"reference": "CERTA-2000-AVI-020",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2000-07-27T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "D\u00e9ni de service"
}
],
"summary": "Tous les produits Acrobat sous Windows sont vuln\u00e9rables lors de la\nlecture d\u0027un fichier PDF malform\u00e9. Au mieux l\u0027application s\u0027arr\u00eate, au\npire du code arbitraire est ex\u00e9cut\u00e9 sur la machine.\n",
"title": "Vuln\u00e9rabilit\u00e9 sous Adobe Acrobat",
"vendor_advisories": [
{
"published_at": null,
"title": "Adobe",
"url": "http://www.adobe.com/misc/pdfsecurity.html"
},
{
"published_at": null,
"title": "Bugtraq",
"url": null
},
{
"published_at": null,
"title": "Security Focus",
"url": null
}
]
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.