CVE-2010-1240
First published: Mon Apr 05 2010(Updated: )
Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in the Launch File warning dialog, which makes it easier for remote attackers to trick users into executing an arbitrary local program that was specified in a PDF document, as demonstrated by a text field that claims that the Open button will enable the user to read an encrypted message.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Acrobat Reader Notification Manager | =9.3.1 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.immunitysec.com/pipermail/dailydave/2010-April/006075.html
- http://blog.didierstevens.com/2010/03/29/escape-from-pdf/
- http://www.adobe.com/support/security/bulletins/apsb10-15.html
- http://blog.didierstevens.com/2010/06/29/quickpost-no-escape-from-pdf/
- http://www.us-cert.gov/cas/techalerts/TA10-231A.html
- http://www.vupen.com/english/advisories/2010/1636
- http://www.securitytracker.com/id?1024159
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7466
Frequently Asked Questions
What is the severity of CVE-2010-1240?
CVE-2010-1240 has a significant severity rating as it allows remote attackers to execute arbitrary local programs.
What versions of Adobe software are affected by CVE-2010-1240?
CVE-2010-1240 affects Adobe Reader and Acrobat 9.x before 9.3.3 and 8.x before 8.2.3 on Windows and Mac OS X.
How do I fix CVE-2010-1240?
To fix CVE-2010-1240, update Adobe Reader or Acrobat to the latest version, at least 9.3.3 or 8.2.3 respectively.
What type of attack is facilitated by CVE-2010-1240?
CVE-2010-1240 facilitates social engineering attacks where users may be tricked into executing malicious local programs.
Are Windows and Mac operating systems vulnerable to CVE-2010-1240?
Yes, both Windows and Mac OS X systems are vulnerable to CVE-2010-1240 when using the affected versions of Adobe software.
- collector/nvd-historical
- agent/softwarecombine
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/adobe
- canonical/adobe acrobat reader notification manager
- version/adobe acrobat reader notification manager/9.3.1
- vendor/microsoft
- canonical/microsoft windows