CVE-2010-2889: Input Validation

Published Oct 4, 2010

Updated

Adobe security bulletin APSB10-21 describes multiple security flaws that can lead to arbitrary code execution when malicious PDF file is opened in Adobe Reader.

http://www.adobe.com/support/security/bulletins/apsb10-21.html

Two of the issues were previously public, as they were exploited in the wild:

This update resolves a font-parsing input validation vulnerability that could lead to code execution (CVE-2010-2883). (see bug #632267)

This update resolves a memory corruption vulnerability in the authplay.dll component that could lead to code execution (CVE-2010-2884). (see bug #633917, affects embedded Flash player)

Additional issues with possible code execution impact:

This update resolves a font-parsing input validation vulnerability that could lead to code execution (CVE-2010-2889).

This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-2890).

This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-3619).

This update resolves an image-parsing input validation vulnerability that could lead to code execution (CVE-2010-3620).

This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-3621).

This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-3622).

This update resolves a prefix protocol handler vulnerability that could lead to code execution (CVE-2010-3625).

This update resolves a font-parsing input validation vulnerability that could lead to code execution (CVE-2010-3626).

This update resolves an input validation vulnerability that could lead to code execution (CVE-2010-3627).

This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-3628).

This update resolves an image-parsing input validation vulnerability that could lead to code execution (CVE-2010-3629).

This update resolves a denial of service vulnerability; arbitrary code execution has not been demonstrated, but may be possible (CVE-2010-3630).

This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-3632).

This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-3658)

Other sources

Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows attackers to execute arbitrary code via a crafted font, a different vulnerability than CVE-2010-3626.

Affected Software

49 affected components

Adobe Acrobat=8.0

Adobe Acrobat=8.1

Adobe Acrobat=8.1.1

Adobe Acrobat=8.1.2

Adobe Acrobat=8.1.3

Adobe Acrobat=8.1.4

Adobe Acrobat=8.1.5

Adobe Acrobat=8.1.6

Adobe Acrobat=8.1.7

Adobe Acrobat=8.2

Adobe Acrobat=8.2.1

Adobe Acrobat=8.2.2

Adobe Acrobat=8.2.3

Adobe Acrobat=8.2.4

Adobe Acrobat reader=8.0

Adobe Acrobat reader=8.1

Adobe Acrobat reader=8.1.1

Adobe Acrobat reader=8.1.2

Adobe Acrobat reader=8.1.4

Adobe Acrobat reader=8.1.5

Adobe Acrobat reader=8.1.6

Adobe Acrobat reader=8.1.7

Adobe Acrobat reader=8.2

Adobe Acrobat reader=8.2.1

Adobe Acrobat reader=8.2.2

Adobe Acrobat reader=8.2.3

Adobe Acrobat reader=8.2.4

Adobe Acrobat=9.0

Adobe Acrobat=9.1

Adobe Acrobat=9.1.1

Adobe Acrobat=9.1.2

Adobe Acrobat=9.1.3

Adobe Acrobat=9.2

Adobe Acrobat=9.3

Adobe Acrobat=9.3.1

Adobe Acrobat=9.3.2

Adobe Acrobat=9.3.3

Adobe Acrobat=9.3.4

Adobe Acrobat reader=9.0

Adobe Acrobat reader=9.1

Adobe Acrobat reader=9.1.1

Adobe Acrobat reader=9.1.2

Adobe Acrobat reader=9.1.3

Adobe Acrobat reader=9.2

Adobe Acrobat reader=9.3

Adobe Acrobat reader=9.3.1

Adobe Acrobat reader=9.3.2

Adobe Acrobat reader=9.3.3

Adobe Acrobat reader=9.3.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.4
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.2.5

Event History

Oct 4, 2010

Data Sourced

via Red Hat·10:01 AM

DescriptionSeverityAffected Software

Oct 6, 2010

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-2889?

CVE-2010-2889 is classified as a critical vulnerability because it allows attackers to execute arbitrary code.

How do I fix CVE-2010-2889?

To fix CVE-2010-2889, update Adobe Reader and Acrobat to version 9.4 or later for 9.x, and version 8.2.5 or later for 8.x.

What software is affected by CVE-2010-2889?

CVE-2010-2889 affects Adobe Reader and Acrobat versions 8.x before 8.2.5 and 9.x before 9.4.

What is the impact of CVE-2010-2889?

The impact of CVE-2010-2889 is significant, as it can lead to a complete system compromise if exploited.

Is CVE-2010-2889 actively exploited?

There have been reports of CVE-2010-2889 being actively exploited in the wild, particularly through crafted fonts.