CERTA-2000-AVI-020

Vulnerability from certfr_avis - Published: - Updated:

Tous les produits Acrobat sous Windows sont vulnérables lors de la lecture d'un fichier PDF malformé. Au mieux l'application s'arrête, au pire du code arbitraire est exécuté sur la machine.

Description

Le format PDF est un format de lecture de document très répandu. Les logiciels de la famille Acrobat permettent de manipuler les documents PDF. Acrobat est vulnérable à un débordement de pile. Dès lors un utilisateur malveillant peut construire un document PDF qui, lors de sa visualisation, stoppe l'application ou exécute du code.

Solution

Correctif pour Acrobat 4.05, Acrobat Reader 4.05, Acrobat Businnes Tools 4.05 et Acrobat Fill In :

ftp://ftp.adobe.com/pub/adobe/win/4.x/ac405up2.exe

En cas de consultation d'un site internet proposant un fichier PDF, enregistrer le fichier concerné afin de l'ouvrir avec la version corrigée d'Acrobat.

None
Impacted products
Vendor Product Description
Adobe Acrobat Acrobat Fill In ;
Adobe Acrobat Adobe Acrobat Reader 4.05 pour Windows ;
Adobe Acrobat Adobe Acrobat Business Tools 4.05 ;
Adobe Acrobat Plugin Acrobat pour navigateur Web (Netscape, Internet Explorer).
Adobe Acrobat Adobe Acrobat 4.05 pour Windows ;
References
Adobe None vendor-advisory
Bugtraq None vendor-advisory
Security Focus None vendor-advisory

Show details on source website

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Acrobat Fill In ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Acrobat Reader 4.05 pour Windows ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Acrobat Business Tools 4.05 ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Plugin Acrobat pour navigateur Web (Netscape, Internet Explorer).",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Acrobat 4.05 pour Windows ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nLe format PDF est un format de lecture de document tr\u00e8s r\u00e9pandu. Les\nlogiciels de la famille Acrobat permettent de manipuler les documents\nPDF. Acrobat est vuln\u00e9rable \u00e0 un d\u00e9bordement de pile. D\u00e8s lors un\nutilisateur malveillant peut construire un document PDF qui, lors de sa\nvisualisation, stoppe l\u0027application ou ex\u00e9cute du code.\n\n## Solution\n\nCorrectif pour Acrobat 4.05, Acrobat Reader 4.05, Acrobat Businnes Tools\n4.05 et Acrobat Fill In :\n\n    ftp://ftp.adobe.com/pub/adobe/win/4.x/ac405up2.exe\n\n  \n  \n\nEn cas de consultation d\u0027un site internet proposant un fichier PDF,\nenregistrer le fichier concern\u00e9 afin de l\u0027ouvrir avec la version\ncorrig\u00e9e d\u0027Acrobat.\n",
  "cves": [],
  "links": [],
  "reference": "CERTA-2000-AVI-020",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2000-07-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": "Tous les produits Acrobat sous Windows sont vuln\u00e9rables lors de la\nlecture d\u0027un fichier PDF malform\u00e9. Au mieux l\u0027application s\u0027arr\u00eate, au\npire du code arbitraire est ex\u00e9cut\u00e9 sur la machine.\n",
  "title": "Vuln\u00e9rabilit\u00e9 sous Adobe Acrobat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Adobe",
      "url": "http://www.adobe.com/misc/pdfsecurity.html"
    },
    {
      "published_at": null,
      "title": "Bugtraq",
      "url": null
    },
    {
      "published_at": null,
      "title": "Security Focus",
      "url": null
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…