Vulnerability Name:

CVE-2008-2042 (CCN-42237)

Assigned:2008-05-06
Published:2008-05-06
Updated:2018-10-30
Summary:The Javascript API in Adobe Acrobat Professional 7.0.9 and possibly 8.1.1 exposes a dangerous method, which allows remote attackers to execute arbitrary commands or trigger a buffer overflow via a crafted PDF file that invokes app.checkForUpdate with a malicious callback function.
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-20
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2008-2042

Source: CCN
Type: SA30840
Sun Solaris Adobe Reader Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
30840

Source: SREASON
Type: UNKNOWN
3861

Source: CCN
Type: SECTRACK ID: 1019971
Adobe Acrobat Javascript API app.checkForUpdate() Function Lets Remote Users Execute Restricted Functions

Source: SECTRACK
Type: UNKNOWN
1019971

Source: SUNALERT
Type: UNKNOWN
239286

Source: CCN
Type: Sun Alert ID: 239286
Multiple Security Vulnerabilities in the Adobe Reader may lead to Execution of Arbitrary Code

Source: CCN
Type: ASA-2008-281
Multiple Security Vulnerabilities in the Adobe Reader may lead to Execution of Arbitrary Code (Sun 239286)

Source: CCN
Type: NORTEL BULLETIN ID: 2008008888, Rev 1
Nortel response to Adobe Advisory APSB08-13 - Multiple Arbitrary Code Execution and Security Vulnerabilities

Source: CCN
Type: Adobe Product Security Bulletin APSB08-13
Security Updates available for Adobe Reader and Acrobat 7 and 8

Source: CONFIRM
Type: Vendor Advisory
http://www.adobe.com/support/security/bulletins/apsb08-13.html

Source: CCN
Type: OSVDB ID: 44998
Adobe Acrobat Javascript API app.checkForUpdate() Function Crafted PDF File Arbitrary Code Execution

Source: BUGTRAQ
Type: UNKNOWN
20080507 Adobe Acrobat Professional Javascript For PDF Security Feature Bypass and Memory Corruption Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2008-1966

Source: XF
Type: UNKNOWN
adobe-appcheckforupdate-code-execution(42237)

Source: XF
Type: UNKNOWN
adobe-appcheckforupdate-code-execution(42237)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:adobe:acrobat:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:3.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:4.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:4.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:4.0.5a:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:4.0.5c:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:5.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:5.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:5.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:5.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:6.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:6.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:6.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:6.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:6.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:6.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:*:*:*:*:*:*:*:* (Version <= 8.1.1)

    • Configuration 2:
  • cpe:/a:adobe:acrobat_reader:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:3.01:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:3.02:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:4.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:4.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:4.0.5a:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:4.0.5c:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:4.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:5.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:5.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:5.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:5.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:5.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:5.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:5.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:5.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:6.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:6.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:6.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:6.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:6.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:6.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:*:*:*:*:*:*:*:* (Version <= 8.1.1)

    • Configuration CCN 1:
  • cpe:/a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.1.1:*:*:*:*:*:*:*
  • AND
  • cpe:/o:sun:solaris:10::sparc:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    adobe acrobat 3.0
    adobe acrobat 3.1
    adobe acrobat 4.0
    adobe acrobat 4.0.5
    adobe acrobat 4.0.5a
    adobe acrobat 4.0.5c
    adobe acrobat 5.0
    adobe acrobat 5.0.5
    adobe acrobat 5.0.6
    adobe acrobat 5.0.10
    adobe acrobat 6.0
    adobe acrobat 6.0.1
    adobe acrobat 6.0.2
    adobe acrobat 6.0.3
    adobe acrobat 6.0.4
    adobe acrobat 6.0.5
    adobe acrobat 6.0.6
    adobe acrobat 7.0
    adobe acrobat 7.0.1
    adobe acrobat 7.0.2
    adobe acrobat 7.0.3
    adobe acrobat 7.0.4
    adobe acrobat 7.0.5
    adobe acrobat 7.0.6
    adobe acrobat 7.0.7
    adobe acrobat 7.0.8
    adobe acrobat 7.0.9
    adobe acrobat 7.1.0
    adobe acrobat 7.1.1
    adobe acrobat 7.1.2
    adobe acrobat 7.1.3
    adobe acrobat 7.1.4
    adobe acrobat 8.0
    adobe acrobat 8.1
    adobe acrobat *
    adobe acrobat reader 3.0
    adobe acrobat reader 3.01
    adobe acrobat reader 3.02
    adobe acrobat reader 4.0
    adobe acrobat reader 4.0.5
    adobe acrobat reader 4.0.5a
    adobe acrobat reader 4.0.5c
    adobe acrobat reader 4.5
    adobe acrobat reader 5.0
    adobe acrobat reader 5.0.5
    adobe acrobat reader 5.0.6
    adobe acrobat reader 5.0.7
    adobe acrobat reader 5.0.9
    adobe acrobat reader 5.0.10
    adobe acrobat reader 5.0.11
    adobe acrobat reader 5.1
    adobe acrobat reader 6.0
    adobe acrobat reader 6.0.1
    adobe acrobat reader 6.0.2
    adobe acrobat reader 6.0.3
    adobe acrobat reader 6.0.4
    adobe acrobat reader 6.0.5
    adobe acrobat reader 6.0.6
    adobe acrobat reader 7.0
    adobe acrobat reader 7.0.1
    adobe acrobat reader 7.0.2
    adobe acrobat reader 7.0.3
    adobe acrobat reader 7.0.4
    adobe acrobat reader 7.0.5
    adobe acrobat reader 7.0.6
    adobe acrobat reader 7.0.7
    adobe acrobat reader 7.0.8
    adobe acrobat reader 7.0.9
    adobe acrobat reader 7.1.0
    adobe acrobat reader 7.1.1
    adobe acrobat reader 7.1.2
    adobe acrobat reader 7.1.3
    adobe acrobat reader 7.1.4
    adobe acrobat reader 8.0
    adobe acrobat reader 8.1
    adobe acrobat reader *
    adobe acrobat reader 7.0
    adobe acrobat reader 7.0.1
    adobe acrobat 7.0
    adobe acrobat 7.0.1
    adobe acrobat reader 7.0.2
    adobe acrobat 8.0
    adobe acrobat reader 8.0
    adobe acrobat reader 7.0.3
    adobe acrobat reader 7.0.4
    adobe acrobat reader 7.0.5
    adobe acrobat reader 7.0.6
    adobe acrobat reader 7.0.7
    adobe acrobat reader 7.0.8
    adobe acrobat 7.0.2
    adobe acrobat 7.0.3
    adobe acrobat 7.0.4
    adobe acrobat 7.0.5
    adobe acrobat 7.0.6
    adobe acrobat 7.0.7
    adobe acrobat 7.0.8
    adobe acrobat 7.0.9
    adobe acrobat 8.1
    adobe acrobat reader 7.0.9
    adobe acrobat reader 8.1
    adobe acrobat 8.1.1
    adobe acrobat reader 8.1.1
    sun solaris 10