Adobe Reader and Acrobat ActiveX Control Remote Code Execution Vulnerabilities
19 Dec. 2006
Summary
Multiple vulnerabilities have been identified in Adobe Reader and Acrobat, which could be exploited by attackers to take complete control of an affected system.
Vulnerable Systems:
* Adobe Reader versions 7.0.0 through 7.0.8
* Adobe Acrobat Standard versions 7.0.0 through 7.0.8
* Adobe Acrobat Professional versions 7.0.0 through 7.0.8
Immune Systems:
* Adobe Reader versions 8.0.0
These flaws are due to memory corruption errors in the AcroPDF ActiveX control (AcroPDF.dll) that does not properly handle malformed arguments passed to the "setPageMode()", "setLayoutMode()", "setNamedDest()", and "LoadFile()" methods, which could be exploited by remote attackers to execute arbitrary commands by tricking a user into visiting a specially crafted web page with Internet Explorer.
