HTTP: Encoded Shellcode in Adobe PDF JavaScript

This signature detects a unicoded Shell code in PDF files sent via HTTP. The presence of a unicoded shell code value in a PDF indicates that something malicious is occurring. It is recommended that you check the PDF contents before running any script included in this document. Some known cases resulted in remote arbitrary code execution. A common malware tactic is to set a OpenAction parameter that runs the malicious JavaScript when the document is opened.

Extended Description

Adobe Reader is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the application or crash the application, denying service to legitimate users. Reader 8.1.4 and 9.1 for Linux are vulnerable; other versions or platforms may also be affected. UPDATE (April 28, 2009): The vendor is investigating this issue. We will update this BID as more information emerges. UPDATE (May 1, 2009): The vendor indicates that fixes will be available by May 12, 2009. Please see the referenced advisory for more information. UPDATE (May 18, 2009): The vendor indicates that fixes for Adobe Reader 7 for Apple Mac OS X will be available by the end of June, 2009. Please see the updated advisory for more information.

Affected Products

Nortel_networks self-service_speech_server,Red_hat enterprise_linux_as_extras

References

BugTraq: 44504 40586 46860 36671 34736 33751

CVE: CVE-2009-2990

URL: http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-021212-5523-99&tabid=1 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=827

Short Name

HTTP:STC:ADOBE:PDF-UNICODED-SC

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Encoded Shellcode in Adobe PDF JavaScript

Extended Description

Affected Products

References

Found a potential security threat?