|
|
| |
Credit:
The information has been provided by binaryproof.
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-11-302/
|
| |
Vulnerable Systems:
* Adobe Reader
User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within because Adobe Reader X includes an old version of libtiff. Adobe can be tricked in using this library by parsing a specially crafted PDF file containing U3D data. Due to the old version of libtiff Adobe Reader is vulnerable to the issue described in CVE-2006-3459 which can be leveraged to execute remote code under the context of the user running the application.
Patch Availability:
Adobe has issued an update to correct this vulnerability. More details can be found at:
http://www.adobe.com/support/security/bulletins/apsb11-24.html
CVE Information:
CVE-2011-2432
Disclosure Timeline:
2011-05-12 - Vulnerability reported to vendor
2011-10-26 - Coordinated public release of advisory
|
|
|
