[ GLSA 200803-01 ] Adobe Acrobat Reader: Multiple vulnerabilities

[Pierre-Yves Rofes <py () gentoo org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                        GLSA 200803-01:04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: Adobe Acrobat Reader: Multiple vulnerabilities
      Date: March 02, 2008
   Updated: March 02, 2008
      Bugs: #170177
        ID: 200803-01:04

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Adobe Acrobat Reader is vulnerable to remote code execution, Denial of
Service, and cross-site request forgery attacks.

Background
==========

Adobe Acrobat Reader is a PDF reader released by Adobe.

Affected packages
=================

    -------------------------------------------------------------------
     Package            /  Vulnerable  /                    Unaffected
    -------------------------------------------------------------------
  1  app-text/acroread       < 8.1.2                          >= 8.1.2

Description
===========

Multiple vulnerabilities have been discovered in Adobe Acrobat Reader,
including:

* A file disclosure when using file:// in PDF documents
  (CVE-2007-1199)

* Multiple buffer overflows in unspecified Javascript methods
  (CVE-2007-5609)

* An unspecified vulnerability in the Escript.api plugin
  (CVE-2007-5663)

* Incorrect handling of printers (CVE-2008-0667)

* An integer overflow when passing incorrect arguments to
  "printSepsWithParams" (CVE-2008-0726)

Impact
======

A remote attacker could entice a user to open a specially crafted
document, possibly resulting in the remote execution of arbitrary code
with the privileges of the user running the application. A remote
attacker could also perform cross-site request forgery attacks, or
cause a Denial of Service.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Adobe Acrobat Reader users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=app-text/acroread-8.1.2"

References
==========

  [ 1 ] CVE-2007-1199
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1199
  [ 2 ] CVE-2007-5659
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5659
  [ 3 ] CVE-2007-5663
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5663
  [ 4 ] CVE-2007-5666
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5666
  [ 5 ] CVE-2008-0655
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0655
  [ 6 ] CVE-2008-0667
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0667
  [ 7 ] CVE-2008-0726
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0726

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200803-01.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security () gentoo org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2008 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHyz/DuhJ+ozIKI5gRAqdDAJ9qQ1nTjVNSIAE9nl72BK6encvr8wCff7g7
Dyk4SPbdcGg9xD5qADtVEkQ=
=Ju/e
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/