search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

CERT Coordination Center

Adobe Acrobat and Reader contain a use-after-free vulnerability in the JavaScript Doc.media.newPlayer method

Vulnerability Note VU#508357

Original Release Date: 2009-12-15 | Last Revised: 2010-06-18

Overview

The Doc.media.newPlayer method in Adobe Acrobat and Reader contains a use-after-free vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

Description

Adobe Reader and the Adobe Acrobat family of software are designed to create, view, and edit Portable Document Format (PDF) files. Adobe Reader is widely deployed, and the Acrobat Reader Plug-In displays PDF inside a web browser.

Adobe Reader and Acrobat support JavaScript. The newplayer() method of the Doc.media object contains a use-after-free vulnerability, which can result in an exploitable memory access violation. This vulnerability is currently being exploited in the wild. Exploit code for this vulnerability is publicly available.

Impact

By convincing a user to open a malicious PDF file, an attacker may be able to execute code or cause a vulnerable PDF viewer to crash. The PDF could be emailed as an attachment or hosted on a website.

Solution

Apply an update
This issue is addressed in Adobe Reader 9.3 and 8.2. Please see Adobe Security Bulletin APSB10-02 for details. Please also consider the following workarounds:


Enable Data Execution Prevention (DEP) in Microsoft Windows

Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can help mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts "Understanding DEP as a mitigation technology" part 1 and part 2. Use of DEP should be considered in conjunction with the application of patches or other mitigations described in this document.

Disable JavaScript in Adobe Reader and Acrobat

Disabling JavaScript prevents these vulnerabilities from being exploited and reduces attack surface. If this workaround is applied to updated versions of Adobe Reader and Acrobat, it may protect against future vulnerabilities.

To disable JavaScript in Adobe Reader:

    1. Open Adobe Acrobat Reader.
    2. Open the Edit menu.
    3. Choose the Preferences... option.
    4. Choose the JavaScript section.
    5. Uncheck the Enable Acrobat JavaScript checkbox.
    Disabling JavaScript will not resolve the vulnerabilities, it will only disable the vulnerable JavaScript component. When JavaScript is disabled, Adobe Reader and Acrobat prompt to re-enable JavaScript when opening a PDF that contains JavaScript.

    Prevent Internet Explorer from automatically opening PDF documents

    The installer for Adobe Reader and Acrobat configures Internet Explorer to automatically open PDF files without any user interaction. This behavior can be reverted to the safer option of prompting the user by importing the following as a .REG file:

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\AcroExch.Document.7]
    "EditFlags"=hex:00,00,00,00
    Disable the displaying of PDF documents in the web browser

    Preventing PDF documents from opening inside a web browser reduces attack surface. If this workaround is applied to updated versions of Adobe Reader and Acrobat, it may protect against future vulnerabilities.

    To prevent PDF documents from automatically being opened in a web browser with Adobe Reader:
      1. Open Adobe Acrobat Reader.
      2. Open the Edit menu.
      3. Choose the Preferences... option.
      4. Choose the Internet section.
      5. Uncheck the Display PDF in browser checkbox.
      Block the use of the Doc.media.newPlayer method

      This specific vulnerability can be mitigated by blocking the use of the newPlayer() method through use of the Adobe Reader and Acrobat JavaScript Blacklist Framework. Windows users can obtain a ZIP file of .REG files that disable the newPlayer() method of the Doc.media object. Upon opening a PDF that attempts to use this method, Adobe Reader and Acrobat will warn the user that a JavaScript that the document uses is disabled for security reasons. Mac and Linux users should see the Blacklist Framework document for details about how to implement the workaround.

      Vendor Information

      508357
       
      Expand all

      Adobe Affected

      Notified:  December 15, 2009 Updated: January 13, 2010

      Status

      Affected

      Vendor Statement

      We have not received a statement from the vendor.

      Vendor Information

      This issue is addressed in Adobe Reader 9.3 and 8.2. Please see Adobe Security Bulletin APSB10-02 for details.

      Vendor References


      CVSS Metrics

      Group Score Vector
      Base
      Temporal
      Environmental

      References

      Acknowledgements

      Thanks to Adobe PSIRT for reporting this vulnerability.

      This document was written by Will Dormann.

      Other Information

      CVE IDs: CVE-2009-4324
      Severity Metric: 65.84
      Date Public: 2009-12-14
      Date First Published: 2009-12-15
      Date Last Updated: 2010-06-18 20:53 UTC
      Document Revision: 19

      Sponsored by CISA.

      Download PGP Key

      Read CERT/CC Blog

      Learn about Vulnerability Analysis