Preemptive Protection against Adobe Reader Download Manager ActiveX Control Buffer Overflow Vulnerability (APSB10-02)
| Check Point Reference: | CPAI-2010-009 | |
| Date Published: | ||
| Preemptive Since: | ||
| Severity: | ||
| Last Updated: | ||
| Source: | Adobe Security Bulletin - APSB10-02 | |
| Industry Reference(s): | CVE-2009-3958 | |
| Protection Provided by: |
Security Gateway
|
|
| Who is Vulnerable? Adobe Reader 9.2 and earlier versions for Windows, Macintosh, and UNIX Adobe Acrobat 9.2 and earlier versions for Windows and Macintosh | ||
| Vulnerability Description A remote code execution vulnerability has been discovered in Adobe Reader and Acrobat NOS Microsystems getPlus+ ActiveX Control. A remote attacker could implant a shell code on a target system using heap spray exploitation method. Heap spraying is a technique for exploiting vulnerabilities in internet browsers (e.g. Internet Explorer, Firefox). Successful exploitation allows execution of arbitrary code on a vulnerable system. |
||
|
Update/Patch Available Update patches: Adobe Security Bulletin - APSB10-02 |
|
|
Vulnerability Details The vulnerability is due to the Adobe Reader and Acrobat NOS Microsystems getPlus+ ActiveX Control. A remote attacker may exploit this issue by specially crafting a Web page that will trigger the vulnerability. Successful exploitation of this issue will create a denial of service condition, causing the application to become non-responsive, and may allow execution of arbitrary code on a vulnerable system. |
Protection Overview
This protection will detect and block a large number of known shell code exploits.
Users are protected against this vulnerability if the protection for blocking known shell codes in the Protection section of SBP-2006-12 has been applied.
In order for the protection to be activated, update your Security Gateway: R75 product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, Protection taband select the version of your choice.
To configure the defense, select your product from the list below and follow the related protection steps.