CVE-2009-3956: XSS
First published: Mon Jan 11 2010(Updated: )
The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a "script injection vulnerability," as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/acroread | <0:9.3-1.el4 | 0:9.3-1.el4 |
| redhat/acroread | <0:9.3-1.el5 | 0:9.3-1.el5 |
| Adobe Acrobat Reader | <=9.2 | |
| Adobe Acrobat Reader | =3.0 | |
| Adobe Acrobat Reader | =3.1 | |
| Adobe Acrobat Reader | =4.0 | |
| Adobe Acrobat Reader | =4.0.5 | |
| Adobe Acrobat Reader | =4.0.5a | |
| Adobe Acrobat Reader | =4.0.5c | |
| Adobe Acrobat Reader | =5.0 | |
| Adobe Acrobat Reader | =5.0.5 | |
| Adobe Acrobat Reader | =5.0.6 | |
| Adobe Acrobat Reader | =5.0.10 | |
| Adobe Acrobat Reader | =6.0 | |
| Adobe Acrobat Reader | =6.0.1 | |
| Adobe Acrobat Reader | =6.0.2 | |
| Adobe Acrobat Reader | =6.0.3 | |
| Adobe Acrobat Reader | =6.0.4 | |
| Adobe Acrobat Reader | =6.0.5 | |
| Adobe Acrobat Reader | =6.0.6 | |
| Adobe Acrobat Reader | =7.0 | |
| Adobe Acrobat Reader | =7.0.1 | |
| Adobe Acrobat Reader | =7.0.2 | |
| Adobe Acrobat Reader | =7.0.3 | |
| Adobe Acrobat Reader | =7.0.4 | |
| Adobe Acrobat Reader | =7.0.5 | |
| Adobe Acrobat Reader | =7.0.6 | |
| Adobe Acrobat Reader | =7.0.7 | |
| Adobe Acrobat Reader | =7.0.8 | |
| Adobe Acrobat Reader | =7.0.9 | |
| Adobe Acrobat Reader | =7.1.0 | |
| Adobe Acrobat Reader | =7.1.1 | |
| Adobe Acrobat Reader | =7.1.2 | |
| Adobe Acrobat Reader | =7.1.3 | |
| Adobe Acrobat Reader | =7.1.4 | |
| Adobe Acrobat Reader | =8.0 | |
| Adobe Acrobat Reader | =8.1 | |
| Adobe Acrobat Reader | =8.1.1 | |
| Adobe Acrobat Reader | =8.1.2 | |
| Adobe Acrobat Reader | =8.1.3 | |
| Adobe Acrobat Reader | =8.1.4 | |
| Adobe Acrobat Reader | =8.1.5 | |
| Adobe Acrobat Reader | =8.1.6 | |
| Adobe Acrobat Reader | =8.1.7 | |
| Adobe Acrobat Reader | =9.0 | |
| Adobe Acrobat Reader | =9.1 | |
| Adobe Acrobat Reader | =9.1.1 | |
| Adobe Acrobat Reader | =9.1.2 | |
| Adobe Acrobat Reader | =9.1.3 | |
| Apple Mac OS X | ||
| Microsoft Windows | ||
| Adobe Acrobat Reader | <=9.2 | |
| Adobe Acrobat Reader | =3.0 | |
| Adobe Acrobat Reader | =3.01 | |
| Adobe Acrobat Reader | =3.02 | |
| Adobe Acrobat Reader | =4.0 | |
| Adobe Acrobat Reader | =4.0.5 | |
| Adobe Acrobat Reader | =4.0.5a | |
| Adobe Acrobat Reader | =4.0.5c | |
| Adobe Acrobat Reader | =4.5 | |
| Adobe Acrobat Reader | =5.0 | |
| Adobe Acrobat Reader | =5.0.5 | |
| Adobe Acrobat Reader | =5.0.6 | |
| Adobe Acrobat Reader | =5.0.7 | |
| Adobe Acrobat Reader | =5.0.9 | |
| Adobe Acrobat Reader | =5.0.10 | |
| Adobe Acrobat Reader | =5.0.11 | |
| Adobe Acrobat Reader | =5.1 | |
| Adobe Acrobat Reader | =6.0 | |
| Adobe Acrobat Reader | =6.0.1 | |
| Adobe Acrobat Reader | =6.0.2 | |
| Adobe Acrobat Reader | =6.0.3 | |
| Adobe Acrobat Reader | =6.0.4 | |
| Adobe Acrobat Reader | =6.0.5 | |
| Adobe Acrobat Reader | =7.0 | |
| Adobe Acrobat Reader | =7.0.1 | |
| Adobe Acrobat Reader | =7.0.2 | |
| Adobe Acrobat Reader | =7.0.3 | |
| Adobe Acrobat Reader | =7.0.4 | |
| Adobe Acrobat Reader | =7.0.5 | |
| Adobe Acrobat Reader | =7.0.6 | |
| Adobe Acrobat Reader | =7.0.7 | |
| Adobe Acrobat Reader | =7.0.8 | |
| Adobe Acrobat Reader | =7.0.9 | |
| Adobe Acrobat Reader | =7.1.0 | |
| Adobe Acrobat Reader | =7.1.1 | |
| Adobe Acrobat Reader | =7.1.2 | |
| Adobe Acrobat Reader | =7.1.3 | |
| Adobe Acrobat Reader | =8.0 | |
| Adobe Acrobat Reader | =8.1 | |
| Adobe Acrobat Reader | =8.1.1 | |
| Adobe Acrobat Reader | =8.1.2 | |
| Adobe Acrobat Reader | =8.1.4 | |
| Adobe Acrobat Reader | =8.1.5 | |
| Adobe Acrobat Reader | =8.1.6 | |
| Adobe Acrobat Reader | =8.1.7 | |
| Adobe Acrobat Reader | =9.0 | |
| Adobe Acrobat Reader | =9.1 | |
| Adobe Acrobat Reader | =9.1.1 | |
| Adobe Acrobat Reader | =9.1.2 | |
| Adobe Acrobat Reader | =9.1.3 | |
| Unix Unix |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.adobe.com/support/security/bulletins/apsb10-02.html
- http://www.vupen.com/english/advisories/2010/0103
- http://www.us-cert.gov/cas/techalerts/TA10-013A.html
- http://www.securitytracker.com/id?1023446
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
- http://secunia.com/advisories/38138
- http://www.packetstormsecurity.org/1001-exploits/SS-2010-001.txt
- http://www.stratsec.net/files/SS-2010-001_Stratsec_Acrobat_Script_Injection_Security_Advisory_v1.0.pdf
- http://www.securityfocus.com/bid/37763
- https://bugzilla.redhat.com/show_bug.cgi?id=554296
- http://secunia.com/advisories/38215
- http://www.redhat.com/support/errata/RHSA-2010-0060.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55554
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8327
- https://access.redhat.com/security/cve/CVE-2009-3956
- https://rhn.redhat.com/errata/RHSA-2010-0037.html
- https://rhn.redhat.com/errata/RHSA-2010-0038.html
- https://rhn.redhat.com/errata/RHSA-2010-0060.html
- https://www.cve.org/CVERecord?id=CVE-2009-3956 https://nvd.nist.gov/vuln/detail/CVE-2009-3956
- https://access.redhat.com/errata/RHSA-2010:0060
- https://access.redhat.com/errata/RHSA-2010:0038
- https://access.redhat.com/errata/RHSA-2010:0037
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-3956.json
Parent vulnerabilities
(Appears in the following advisories)
- collector/nvd-historical
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-3956
- agent/severity
- agent/references
- agent/description
- agent/remedy
- agent/weakness
- agent/author
- collector/redhat-cve
- agent/software-canonical-lookup
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/tags
- agent/source
- package-manager/redhat
- vendor/adobe
- canonical/adobe acrobat reader
- version/adobe acrobat reader/9.2
- version/adobe acrobat reader/3.0
- version/adobe acrobat reader/3.1
- version/adobe acrobat reader/4.0
- version/adobe acrobat reader/4.0.5
- version/adobe acrobat reader/4.0.5a
- version/adobe acrobat reader/4.0.5c
- version/adobe acrobat reader/5.0
- version/adobe acrobat reader/5.0.5
- version/adobe acrobat reader/5.0.6
- version/adobe acrobat reader/5.0.10
- version/adobe acrobat reader/6.0
- version/adobe acrobat reader/6.0.1
- version/adobe acrobat reader/6.0.2
- version/adobe acrobat reader/6.0.3
- version/adobe acrobat reader/6.0.4
- version/adobe acrobat reader/6.0.5
- version/adobe acrobat reader/6.0.6
- version/adobe acrobat reader/7.0
- version/adobe acrobat reader/7.0.1
- version/adobe acrobat reader/7.0.2
- version/adobe acrobat reader/7.0.3
- version/adobe acrobat reader/7.0.4
- version/adobe acrobat reader/7.0.5
- version/adobe acrobat reader/7.0.6
- version/adobe acrobat reader/7.0.7
- version/adobe acrobat reader/7.0.8
- version/adobe acrobat reader/7.0.9
- version/adobe acrobat reader/7.1.0
- version/adobe acrobat reader/7.1.1
- version/adobe acrobat reader/7.1.2
- version/adobe acrobat reader/7.1.3
- version/adobe acrobat reader/7.1.4
- version/adobe acrobat reader/8.0
- version/adobe acrobat reader/8.1
- version/adobe acrobat reader/8.1.1
- version/adobe acrobat reader/8.1.2
- version/adobe acrobat reader/8.1.3
- version/adobe acrobat reader/8.1.4
- version/adobe acrobat reader/8.1.5
- version/adobe acrobat reader/8.1.6
- version/adobe acrobat reader/8.1.7
- version/adobe acrobat reader/9.0
- version/adobe acrobat reader/9.1
- version/adobe acrobat reader/9.1.1
- version/adobe acrobat reader/9.1.2
- version/adobe acrobat reader/9.1.3
- vendor/apple
- canonical/apple mac os x
- vendor/microsoft
- canonical/microsoft windows
- version/adobe acrobat reader/3.01
- version/adobe acrobat reader/3.02
- version/adobe acrobat reader/4.5
- version/adobe acrobat reader/5.0.7
- version/adobe acrobat reader/5.0.9
- version/adobe acrobat reader/5.0.11
- version/adobe acrobat reader/5.1
- vendor/unix
- canonical/unix unix