SB2010090802 - Remote code execution in Adobe Reader

Description

This security bulletin contains information about 1 security vulnerability.

1) Stack-based buffer overflow (CVE-ID: CVE-2010-2883)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling specially crafted fonts within PDF document. A remote attacker can create a specially crafted PDF document, trick the victim into opening it, cause stack-based buffer overflow and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Remediation

Install update from vendor's website.

References

• http://www.adobe.com/support/security/advisories/apsa10-02.html
• http://www.adobe.com/support/security/bulletins/apsb10-21.html