Vulnerability CVE-2009-3431

Vulnerability Name:

CVE-2009-3431 (CCN-51103)

Assigned:

2009-05-29

Published:

2009-05-29

Updated:

2017-09-19

Summary:

Stack consumption vulnerability in Adobe Reader and Acrobat 9.1.3, 9.1.2, 9.1.1, and earlier 9.x versions; 8.1.6 and earlier 8.x versions; and possibly 7.1.4 and earlier 7.x versions allows remote attackers to cause a denial of service (application crash) via a PDF file with a large number of [ (open square bracket) characters in the argument to the alert method.
Note: some of these details are obtained from third party information.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
4.1 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Access Complexity (AC): Authentication (Au):
Impact Metrics:	Confidentiality (C): Integrity (I): Availibility (A):

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
3.6 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Access Complexity (AC): Athentication (Au):
Impact Metrics:	Confidentiality (C): Integrity (I): Availibility (A):

4.3 Medium (REDHAT CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
3.6 Low (REDHAT Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Access Complexity (AC): Authentication (Au):
Impact Metrics:	Confidentiality (C): Integrity (I): Availibility (A):

Vulnerability Type:

CWE-119

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2009-3431

Source: CCN
Type: RHSA-2009-1499
Critical: acroread security update

Source: CCN
Type: SECTRACK ID: 1023007
Adobe Acrobat and Adobe Reader Flaws Lets Remote Users Execute Arbitrary Code and Deny Service

Source: SECTRACK
Type: UNKNOWN
1023007

Source: CCN
Type: Sun Alert: 270669
Multiple Security Vulnerabilities in Adobe Reader for Solaris 10 May Allow Execution of Arbitrary Code or Cause Denial of Service (DoS) - Adobe Security Bulletin APSB09-15

Source: CCN
Type: Adobe Web site
Acrobat and Reader

Source: CCN
Type: Adobe Product Security Bulletin APSB09-15
Security Advisory for Adobe Reader and Acrobat

Source: CONFIRM
Type: UNKNOWN
http://www.adobe.com/support/security/bulletins/apsb09-15.html

Source: CCN
Type: GLSA-200910-03
Adobe Reader: Multiple vulnerabilities

Source: BID
Type: Exploit
35148

Source: CCN
Type: BID-35148
Adobe Acrobat Stack Exhaustion Denial of Service Vulnerability

Source: CERT
Type: US Government Resource
TA09-286B

Source: VUPEN
Type: Vendor Advisory
ADV-2009-2898

Source: XF
Type: UNKNOWN
acrobat-reader-unspecified-dos(51103)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:6532

Source: SUSE
Type: SUSE-SA:2009:049
Acrobat Reader Security update

Vulnerable Configuration:

Configuration 1:

cpe:/a:adobe:acrobat:7.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.1:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.1:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.2:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.2:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.3:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.3:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.4:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.4:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.5:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.5:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.6:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.6:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.7:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.7:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.8:*:elements:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.8:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.8:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.9:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.1:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.1:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.1.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.1.1:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.0:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.0:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.1:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.1:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.2:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.2:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.2:security_update:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.3:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.3:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.4:*:professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.4:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.0:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.0.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1:*:standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.9:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.1.2:security_update:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.1.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.1.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.1.3:*:*:*:*:*:*:*

Configuration RedHat 1:

cpe:/a:redhat:rhel_extras:3:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/a:redhat:rhel_extras:4:*:*:*:*:*:*:*

Configuration RedHat 3:

cpe:/a:redhat:rhel_extras:5:*:*:*:*:*:*:*

Denotes that component is vulnerable

Vulnerability Name:

CVE-2009-3431 (CCN-53756)

Assigned:

2009-09-29

Published:

2009-09-29

Updated:

2009-09-29

Summary:

Adobe Acrobat is vulnerable to a denial of service, caused stack consumption error. By persuading a victim to open a specially-crafted PDF file containing overly long data passed to the alert method, a remote attacker could exploit this vulnerability to cause a denial of service.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
4.1 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Access Complexity (AC): Authentication (Au):
Impact Metrics:	Confidentiality (C): Integrity (I): Availibility (A):

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
3.6 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Access Complexity (AC): Athentication (Au):
Impact Metrics:	Confidentiality (C): Integrity (I): Availibility (A):

4.3 Medium (REDHAT CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
3.6 Low (REDHAT Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Access Complexity (AC): Authentication (Au):
Impact Metrics:	Confidentiality (C): Integrity (I): Availibility (A):

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2009-3431

Source: CCN
Type: RHSA-2009-1499
Critical: acroread security update

Source: CCN
Type: SECTRACK ID: 1023007
Adobe Acrobat and Adobe Reader Flaws Lets Remote Users Execute Arbitrary Code and Deny Service

Source: CCN
Type: Sun Alert: 270669
Multiple Security Vulnerabilities in Adobe Reader for Solaris 10 May Allow Execution of Arbitrary Code or Cause Denial of Service (DoS) - Adobe Security Bulletin APSB09-15

Source: CCN
Type: Adobe Web site
Adobe - Adobe Reader download

Source: CCN
Type: Adobe Product Security Bulletin APSB09-15
Security Advisory for Adobe Reader and Acrobat

Source: CCN
Type: GLSA-200910-03
Adobe Reader: Multiple vulnerabilities

Source: CCN
Type: BID-35148
Adobe Acrobat Stack Exhaustion Denial of Service Vulnerability

Source: XF
Type: UNKNOWN
adobe-acrobat-alert-dos(53756)

Source: SUSE
Type: SUSE-SA:2009:049
Acrobat Reader Security update

Vulnerable Configuration:

Configuration RedHat 1:

cpe:/a:redhat:rhel_extras:3:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/a:redhat:rhel_extras:4:*:*:*:*:*:*:*

Configuration RedHat 3:

cpe:/a:redhat:rhel_extras:5:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:adobe:acrobat:7.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:3.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:3.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:4.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:4.0.5a:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:4.0.5c:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:5.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:5.0.10:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:5.0.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:5.0.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:6.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:6.0.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:6.0.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:6.0.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:6.0.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:6.0.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.0.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.6:*:*:*:*:*:*:*

AND

cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*

OR cpe:/o:sun:solaris:10:*:sparc:*:*:*:*:*

OR cpe:/a:redhat:rhel_extras:3:*:*:*:*:*:*:*

OR cpe:/a:redhat:rhel_extras:4:*:*:*:*:*:*:*

OR cpe:/o:opensuse:opensuse:10.3:*:*:*:*:*:*:*

OR cpe:/o:opensuse:opensuse:11.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20093431	V	CVE-2009-3431	2015-11-16
oval:org.mitre.oval:def:22955	P	ELSA-2009:1499: acroread security update (Critical)	2014-05-26
oval:org.mitre.oval:def:6532	V	Adobe Reader and Acrobat denial of service (application crash) via a PDF	2013-08-12
oval:com.redhat.rhsa:def:20091499	P	RHSA-2009:1499: acroread security update (Critical)	2009-10-14

BACK