Title: Adobe Acrobat JavaScript Parsing Engine Arbitrary Code Execution Vulnerability
Severity: HIGH
Description:
Adobe Acrobat is an application that allows PDF documents to be viewed.
Adobe Acrobat Full has been reported prone to an input validation vulnerability.
It has been reported that this issue presents itself as a flaw in the Adobe JavaScript parsing engine. An attacker may craft a malicious PDF file embedding JavaScript code that instructs Acrobat to write attacker-supplied code into the users 'Plug-ins' folder.
Because of the intended 'Plug-ins' folder functionality any file contained in the users 'Plug-ins' folder will be loaded and executed every time Acrobat is launched. This function gives the attacker the opportunity to supply and execute arbitrary code in the context of the user running Adobe every time the vulnerable application is launched.
It should be noted that Adobe have reported that Acrobat Reader is not affected.
Affected Products:
- Adobe Acrobat 5.0.0
- Adobe Acrobat 5.0.5
References:
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
