Vulnerability CVE-2011-2441 - CERT Civis.Net

Vulnerability Name:

CVE-2011-2441 (CCN-69779)

Assigned:

2011-09-13

Published:

2011-09-13

Updated:

2017-09-19

Summary:

Multiple stack-based buffer overflows in CoolType.dll in Adobe Reader and Acrobat 8.x before 8.3.1, 9.x before 9.4.6, and 10.x before 10.1.1 allow attackers to execute arbitrary code via unspecified vectors.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2011-2441

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2011:1238

Source: SUSE
Type: UNKNOWN
SUSE-SU-2011:1239

Source: SUSE
Type: UNKNOWN
SUSE-SA:2011:044

Source: CCN
Type: SA45978
Adobe Reader / Acrobat Multiple Vulnerabilities

Source: CCN
Type: Adobe Product Security Bulletin APSB11-24
Security updates available for Adobe Reader and Acrobat

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.adobe.com/support/security/bulletins/apsb11-24.html

Source: CCN
Type: OSVDB ID: 75441
Adobe Reader / Acrobat CoolType.dll Multiple Unspecified Overflows

Source: CCN
Type: BID-49581
Adobe Acrobat and Reader CVE-2011-2441 Multiple Remote Stack Buffer Overflow Vulnerabilities

Source: XF
Type: UNKNOWN
adobe-cooltype-library-bo(69779)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:14044

Source: CCN
Type: ZDI-11-284
Adobe Reader Compound Glyphs Array Indexing Error Remote Code Execution Vulnerability

Source: CCN
Type: ZDI-11-310
Adobe Reader Compound Glyph Index Sign Extension Remote Code Execution Vulnerability

Vulnerable Configuration:

Configuration 1:

cpe:/a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.1.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.1.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.1.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.1.7:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.2.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.2.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.2.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.2.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.2.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.3.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.3.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.3.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.3.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.4.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.4.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.4.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:9.4.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.0.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.0.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.0.3:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:adobe:acrobat:8.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.7:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.2.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.2.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.2.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.2.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.2.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.2.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.3.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.3.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.3.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.3.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.4.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.4.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.4.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.4.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.4.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.0.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.0.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.0.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.1:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:adobe:acrobat:9:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.0::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.0::professional_extended:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.0::standard:*:*:*:*:*

OR cpe:/a:adobe:reader:8.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:8.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:8.1.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.0.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1::standard:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:8.1.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:8.1.7:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:8.1.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.3.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:spelling_dictionaries_support_for_adobe_reader:8.0.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:8.0.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.3.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.3.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.3.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.3.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.3.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.3.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.3.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.2.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.4.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.4.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.2.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:8.2.6:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20112441	V	CVE-2011-2441	2015-11-16
oval:org.mitre.oval:def:14044	V	Multiple stack-based buffer overflows in CoolType.dll in Adobe Reader and Acrobat 8.x before 8.3.1, 9.x before 9.4.6, and 10.x before 10.1.1 allow attackers to execute arbitrary code via unspecified vectors.	2014-10-06