CVE-2009-4324: Adobe Acrobat and Reader Use-After-Free Vulnerability

Published Dec 14, 2009

Updated

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4324 to the following vulnerability:

Name: CVE-2009-4324 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4324 Assigned: 20091214 Reference: MISC: http://blogs.adobe.com/psirt/2009/12/newadobereaderandacrobatv.html

Unspecified vulnerability in Adobe Reader and Acrobat 9.2 and earlier has unknown impact and attack vectors, as exploited in the wild in December 2009.

An unconfirmed third-party posting [1] indicates this vulnerability is in the JavaScript processing, so a proposed work-around is to disable JavaScript (Edit -> Preferences -> JavaScript). This has not been official confirmed by Adobe.

[1] http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214

Other sources

Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.

— CISA

Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

— Red Hat

Affected Software

76 affected componentsFixes available

redhat/acroread<0:9.3-1.el4

0:9.3-1.el4

redhat/acroread<0:9.3-1.el5

0:9.3-1.el5

Adobe Acrobat<=9.2

Adobe Acrobat=6.0

Adobe Acrobat=6.0.1

Adobe Acrobat=6.0.2

Adobe Acrobat=6.0.3

Adobe Acrobat=6.0.4

Adobe Acrobat=6.0.5

Adobe Acrobat=7.0

Adobe Acrobat=7.0.1

Adobe Acrobat=7.0.2

Adobe Acrobat=7.0.3

Adobe Acrobat=7.0.4

Adobe Acrobat=7.0.5

Adobe Acrobat=7.0.6

Adobe Acrobat=7.0.7

Adobe Acrobat=7.0.8

Adobe Acrobat=7.0.9

Adobe Acrobat=8.0

Adobe Acrobat=8.1

Adobe Acrobat=8.1.1

Adobe Acrobat=8.1.2

Adobe Acrobat=9.0

Adobe Acrobat=9.1

Adobe Acrobat Reader<=9.2

Adobe Acrobat Reader=3.0

Adobe Acrobat Reader=4.0

Adobe Acrobat Reader=4.0.5

Adobe Acrobat Reader=4.0.5a

Adobe Acrobat Reader=4.0.5c

Adobe Acrobat Reader=4.5

Adobe Acrobat Reader=5.0

Adobe Acrobat Reader=5.0.5

Adobe Acrobat Reader=5.0.6

Adobe Acrobat Reader=5.0.7

Adobe Acrobat Reader=5.0.9

Adobe Acrobat Reader=5.0.10

Adobe Acrobat Reader=5.0.11

Adobe Acrobat Reader=5.1

Adobe Acrobat Reader=6.0

Adobe Acrobat Reader=6.0.1

Adobe Acrobat Reader=6.0.2

Adobe Acrobat Reader=6.0.3

Adobe Acrobat Reader=6.0.4

Adobe Acrobat Reader=6.0.5

Adobe Acrobat Reader=7.0

Adobe Acrobat Reader=7.0.1

Adobe Acrobat Reader=7.0.2

Adobe Acrobat Reader=7.0.3

Adobe Acrobat Reader=7.0.4

Adobe Acrobat Reader=7.0.5

Adobe Acrobat Reader=7.0.6

Adobe Acrobat Reader=7.0.7

Adobe Acrobat Reader=7.0.8

Adobe Acrobat Reader=7.0.9

Adobe Acrobat Reader=8.0

Adobe Acrobat Reader=8.1

Adobe Acrobat Reader=8.1.1

Adobe Acrobat Reader=8.1.2

Adobe Acrobat Reader=9.0

Adobe Acrobat Reader=9.1

Adobe Acrobat=9.1

Adobe Acrobat=9.0

Adobe Acrobat<=9.2

Adobe Acrobat and Reader

All of the following

Any of the following

Adobe Acrobat>=8.0<8.2

Adobe Acrobat>=9.0<9.3

Adobe Acrobat Reader>=8.0<8.2

Adobe Acrobat Reader>=9.0<9.3

Microsoft Windows

SUSE Linux Enterprise Debuginfo=11

openSUSE openSUSE=11.1

openSUSE openSUSE=11.2

SUSE Linux Enterprise=10.0-sp2

SUSE Linux Enterprise=10.0-sp3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/acroread to a version that resolves this vulnerability.
Fixed in 0:9.3-1.el4
Upgrade
Upgrade redhat/acroread to a version that resolves this vulnerability.
Fixed in 0:9.3-1.el5
Upgrade
Upgrade Adobe Acrobat and Reader to a version that resolves this vulnerability.
Fixed in 9.3
Upgrade
Upgrade Adobe Acrobat and Reader to a version that resolves this vulnerability.
Fixed in 8.2
Configuration
Disable JavaScript via Edit -> Preferences -> JavaScript in Adobe Acrobat/Reader
Adobe Acrobat and Reader JavaScript = disabled

Event History

Dec 14, 2009

CVE Published

via Red Hat·12:00 AM

Dec 15, 2009

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Data Sourced

via NVD·02:30 AM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via Red Hat·06:01 PM

DescriptionSeverityAffected Software

Jun 8, 2022

Known Exploited

via CISA·12:00 AM

Feb 28, 58274

Event

via NVD·11:24 PM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2009-4324?

The severity of CVE-2009-4324 is classified as critical, as it allows remote attackers to execute code via crafted PDF files.

How do I fix CVE-2009-4324?

To fix CVE-2009-4324, users should update to Adobe Acrobat and Reader versions 9.3 and above or 8.2 and above.

Which versions of Adobe products are affected by CVE-2009-4324?

CVE-2009-4324 affects Adobe Acrobat Reader versions before 9.3 and 8.x before 8.2 as well as several earlier versions.

What type of vulnerability is CVE-2009-4324?

CVE-2009-4324 is a use-after-free vulnerability that can be exploited to execute arbitrary code.

Is there a known exploit for CVE-2009-4324?

Yes, there have been reports of exploits that take advantage of CVE-2009-4324, specifically targeting crafted PDF files.

CVE-2009-4324: Adobe Acrobat and Reader Use-After-Free Vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2009-4324?

How do I fix CVE-2009-4324?

Which versions of Adobe products are affected by CVE-2009-4324?

What type of vulnerability is CVE-2009-4324?

Is there a known exploit for CVE-2009-4324?

Company

Resources

Contact