AusCERT - AL-2009.0018 -- [Win][UNIX/Linux] -- Critical update for Adobe Reader 9 and Acrobat 9

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
AL-2009.0018 -- [Win][UNIX/Linux] -- Critical update for Adobe Reader 9 and Acrobat 9
Date: 24 March 2009
References: ESB-2009.0162 ESB-2009.0286 ESB-2009.0368

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2009.0018 -- AUSCERT ALERT
                             [Win][UNIX/Linux]
             Critical update for Adobe Reader 9 and Acrobat 9
                               25 March 2009

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              Adobe Acrobat 9
                      Adobe Reader 9
Publisher:            Adobe
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact:               Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated
CVE Names:            CVE-2009-0193 CVE-2009-0658 CVE-2009-0928
                      CVE-2009-1061 CVE-2009-1062

Ref:                  ESB-2009.0162

Original Bulletin:    
  http://www.adobe.com/support/security/bulletins/apsb09-03.html

Comment: Updates for versions 7 and 8 should be released by March 18.
         
         This vulnerability can be exploited without even opening the
         malicious PDF file on some systems.

Revision History:     March 25 2009: Added CVE References
                      March 11 2009: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

Adobe Security bulletin

Security Updates available for Adobe Reader 9 and Acrobat 9

   Release date: March 10, 2009

   Vulnerability identifier: APSB09-03

   CVE number: CVE-2009-0658

   Platform: All Platforms

Summary

   A critical vulnerability has been identified in Adobe Reader 9 and
   Acrobat 9 and earlier versions. This vulnerability would cause the
   application to crash and could potentially allow an attacker to take
   control of the affected system. There are reports that this issue is
   being exploited.

   Adobe recommends users of Adobe Reader and Acrobat 9 update to Adobe
   Reader 9.1 and Acrobat 9.1. Adobe is planning to make available
   updates for Adobe Reader 7 and 8, and Acrobat 7 and 8, by March 18. In
   addition, Adobe plans to make available Adobe Reader 9.1 for Unix by
   March 25.

Affected software versions

   Adobe Reader 9 and earlier versions
   Adobe Acrobat 9 Standard, Pro, and Pro Extended and earlier versions

Solution

   Adobe Reader

   Adobe recommends Adobe Reader users update to Adobe Reader 9.1,
   available here:
   http://get.adobe.com/reader/

   Acrobat 9

   Adobe recommends Acrobat 9 Standard and Acrobat 9 Pro users on Windows
   update to Acrobat 9.1, available at the following URLs:
   http://www.adobe.com/support/downloads/detail.jsp?ftpID=4375
   http://www.adobe.com/support/downloads/detail.jsp?ftpID=4382

   Adobe recommends Acrobat 9 Pro Extended users on Windows update to
   Acrobat 9.1, available here:
   http://www.adobe.com/support/downloads/detail.jsp?ftpID=4381

   Adobe recommends Acrobat 9 Pro users on Macintosh update to Acrobat
   9.1, available here:
   http://www.adobe.com/support/downloads/detail.jsp?ftpID=4374

Severity rating

   Adobe categorizes this as a critical issue and recommends that
   users apply the update for their product installations.

Details

   A critical vulnerability has been identified in Adobe Reader 9 and
   Acrobat 9 and earlier versions. This vulnerability would cause the
   application to crash and could potentially allow an attacker to take
   control of the affected system. This issue is remotely exploitable.
   There are reports that this issue is being exploited.

   Adobe recommends users of Adobe Reader and Acrobat 9 update to Adobe
   Reader 9.1 and Acrobat 9.1. Adobe is planning to make available
   updates for Adobe Reader 7 and 8, and Acrobat 7 and 8, by March 18. In
   addition, Adobe plans to make available Adobe Reader 9.1 for Unix by
   March 25.

   Adobe is also in contact with anti-virus and security vendors,
   including McAfee, Symantec and others, on this issue in order to
   ensure the security of our mutual customers. For Adobe Reader 7 and 8
   users who are unable to update to Adobe Reader 9.1, as well as Acrobat
   7 and 8 users, more information on immediate protection for this issue
   from anti-virus and security vendors is available on the Adobe
   Product Security Incident Response Team blog.

   A security bulletin will be published on
   http://www.adobe.com/support/security as soon as further product
   updates are available. Users may also monitor the latest information
   on the Adobe Product Security Incident Response Team blog at the
   following URL: http://blogs.adobe.com/psirt or by subscribing to
   the RSS feed here: http://blogs.adobe.com/psirt/atom.xml

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation\'s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT\'s members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation\'s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author\'s website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFJycK6NVH5XJJInbgRAjvDAJ4/R77CEMuIIvK7mGcUT9+CRlellgCfV+cU
k0MXoRRd0BZzJR8PXDqtH1I=
=AG+C
-----END PGP SIGNATURE-----