Vulnerability Name:

CVE-2007-5020 (CCN-36722)

Assigned:2007-09-20
Published:2007-09-20
Updated:2018-10-15
Summary:Unspecified vulnerability in Adobe Acrobat and Reader 8.1 on Windows allows remote attackers to execute arbitrary code via a crafted PDF file, related to the mailto: option and Internet Explorer 7 on Windows XP.
Note: this information is based upon a vague pre-advisory by a reliable researcher.
CVSS v3 Severity:9.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
7.7 High (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.6 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)
6.3 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-noinfo
CWE-94
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: Full-Disclosure Mailing List, Tue Oct 16 2007 - 07:00:14 CDT
0-day PDF exploit

Source: MITRE
Type: CNA
CVE-2007-5020

Source: CCN
Type: SECTRACK ID: 1018723
Adobe Reader Unspecified Bug Lets Remote Users Execute Arbitrary Code

Source: CCN
Type: Adobe Reader Web site
Adobe - Reader Download

Source: CCN
Type: Adobe Product Security Advisory APSA07-04
Workaround available for vulnerability in versions 8.1 and earlier of Adobe Reader and Acrobat

Source: CONFIRM
Type: UNKNOWN
http://www.adobe.com/support/security/advisories/apsa07-04.html

Source: CCN
Type: Adobe Product Security Bulletin APSB07-18
Update available for vulnerability in versions 8.1 and earlier of Adobe Reader and Acrobat

Source: CCN
Type: Gnucitizen Blog, September 20th, 2007
0day: PDF pwns Windows

Source: MISC
Type: UNKNOWN
http://www.gnucitizen.org/blog/0day-pdf-pwns-windows

Source: CCN
Type: OSVDB ID: 38068
Adobe Acrobat / Reader Crafted PDF File Arbitrary Code Execution

Source: BUGTRAQ
Type: UNKNOWN
20070920 0day: PDF pwns Windows

Source: BID
Type: UNKNOWN
25748

Source: CCN
Type: BID-25748
Adobe Acrobat Mailto PDF File Command Execution Vulnerability

Source: SECTRACK
Type: UNKNOWN
1018723

Source: CERT
Type: US Government Resource
TA07-297B

Source: VUPEN
Type: Vendor Advisory
ADV-2007-3392

Source: XF
Type: UNKNOWN
adobe-unspecified-pdf-code-execution(36722)

Source: XF
Type: UNKNOWN
adobe-unspecified-pdf-code-execution(36722)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:adobe:acrobat:8.1:*:windows:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.1:*:windows:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.1.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    adobe acrobat 8.1
    adobe acrobat reader 8.1
    adobe acrobat reader 7.0
    adobe acrobat reader 7.0.1
    adobe acrobat 7.0
    adobe acrobat 7.0.1
    adobe acrobat reader 7.0.2
    adobe acrobat 8.0
    adobe acrobat reader 8.0
    adobe acrobat reader 8.1.2
    adobe acrobat reader 7.0.3
    adobe acrobat reader 7.0.4
    adobe acrobat reader 7.0.5
    adobe acrobat reader 7.0.6
    adobe acrobat reader 7.0.7
    adobe acrobat reader 7.0.8
    adobe acrobat 7.0.2
    adobe acrobat 7.0.3
    adobe acrobat 7.0.4
    adobe acrobat 7.0.5
    adobe acrobat 7.0.6
    adobe acrobat 7.0.7
    adobe acrobat 7.0.8
    adobe acrobat 7.0.9
    adobe acrobat 8.1
    adobe acrobat reader 7.0.9
    adobe acrobat reader 8.1
    adobe acrobat 8.1.1
    adobe acrobat reader 8.1.1