Adobe Reader < 10.1.1 / 9.4.6 / 8.3.1 Multiple Vulnerabilities (APSB11-21, APSB11-24, APSB11-26) (Mac OS X)

high Nessus プラグイン ID 56199
New! プラグインの深刻度には CVSS v3 が適用されるようになりました。

プラグインの深刻度は、デフォルトで CVSS v3 を使って計算されるように更新されました。プラグインに CVSS v3 スコアがない場合には、CVSS v2 を使って深刻度が計算されます。深刻度の表示設定は、[設定]のドロップダウンで切り替えができます。

概要

The version of Adobe Reader on the remote Mac OS X host is affected by multiple vulnerabilities.

説明

The version of Adobe Reader installed on the remote Mac OS X host is prior to 10.1.1, 9.4.6, or 8.3.1. It is, therefore, affected by the following vulnerabilities :

- An unspecified error exists that allows an attacker to bypass security restrictions, resulting in code execution. (CVE-2011-2431)

- Multiple buffer overflow conditions exists that allow an attacker to execute arbitrary code. (CVE-2011-2432, CVE-2011-2435)

- Multiple heap overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2011-2433, CVE-2011-2434, CVE-2011-2436, CVE-2011-2437)

- Multiple stack overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2011-2438)

- An error exists related to memory leak issues that allows an attacker to execute arbitrary code.
(CVE-2011-2439)

- A use-after-free error exists that allows an attacker to execute arbitrary code. (CVE-2011-2440)

- Multiple errors exist in the CoolType.dll library that can allow stack overflow conditions, resulting in code execution. (CVE-2011-2441)

- A logic error exists that allows an attacker to execute arbitrary code. (CVE-2011-2442)

- Multiple vulnerabilities exist, as noted in APSB11-21, that can allow an attacker to take control of the affected system or cause the application to crash.
(CVE-2011-2130, CVE-2011-2134, CVE-2011-2135, CVE-2011-2136, CVE-2011-2137, CVE-2011-2138, CVE-2011-2139, CVE-2011-2140, CVE-2011-2414, CVE-2011-2415, CVE-2011-2416, CVE-2011-2417, CVE-2011-2425, CVE-2011-2424)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ソリューション

Upgrade to Adobe Reader version 10.1.1 / 9.4.6 / 8.3.1 or later.

関連情報

http://www.adobe.com/support/security/bulletins/apsb11-21.html

http://www.adobe.com/support/security/bulletins/apsb11-24.html

http://www.adobe.com/support/security/bulletins/apsb11-26.html

プラグインの詳細

深刻度: High

ID: 56199

ファイル名: macosx_adobe_reader_apsb11-24.nasl

バージョン: 1.16

タイプ: local

エージェント: macosx

公開日: 2011/9/14

更新日: 2018/7/14

依存関係: macosx_adobe_reader_installed.nasl

リスク情報

VPR

リスクファクター: Critical

スコア: 9.5

CVSS v2

リスクファクター: High

Base Score: 9.3

Temporal Score: 8.1

ベクトル: AV:N/AC:M/Au:N/C:C/I:C/A:C

現状ベクトル: E:H/RL:OF/RC:C

脆弱性情報

CPE: cpe:/a:adobe:acrobat_reader

必要な KB アイテム: Host/local_checks_enabled, Host/MacOSX/Version, installed_sw/Adobe Reader

エクスプロイトが利用可能: true

エクスプロイトの容易さ: Exploits are available

パッチ公開日: 2011/9/13

脆弱性公開日: 2011/9/13

エクスプロイト可能

Core Impact

Metasploit (Adobe Flash Player MP4 SequenceParameterSetNALUnit Buffer Overflow)

参照情報

CVE: CVE-2011-1353, CVE-2011-2130, CVE-2011-2134, CVE-2011-2135, CVE-2011-2136, CVE-2011-2137, CVE-2011-2138, CVE-2011-2139, CVE-2011-2140, CVE-2011-2414, CVE-2011-2415, CVE-2011-2416, CVE-2011-2417, CVE-2011-2424, CVE-2011-2425, CVE-2011-2426, CVE-2011-2427, CVE-2011-2428, CVE-2011-2429, CVE-2011-2430, CVE-2011-2431, CVE-2011-2432, CVE-2011-2433, CVE-2011-2434, CVE-2011-2435, CVE-2011-2436, CVE-2011-2437, CVE-2011-2438, CVE-2011-2439, CVE-2011-2440, CVE-2011-2441, CVE-2011-2442, CVE-2011-2444

BID: 49073, 49074, 49075, 49076, 49077, 49079, 49080, 49081, 49082, 49083, 49084, 49085, 49086, 49186, 49572, 49575, 49576, 49577, 49578, 49579, 49580, 49581, 49582, 49583, 49584, 49585, 49586, 49710, 49714, 49715, 49716, 49717, 49718