CVE-2007-5659
HIGH KEVAdobe Acrobat and Reader < 8.1.2 - Remote Code Execution via Long JavaScript Method Arguments
Title source: llmExploitation Summary
CVE-2007-5659 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added June 8, 2022.
EIP tracks 3 public exploits from researchers including Metasploit, Paul Craig, MC, including a Metasploit module exploits/windows/fileformat/adobe_collectemailinfo.
AI-analyzed exploit summary This exploit leverages a buffer overflow in Adobe Reader and Acrobat Professional 8.1.1 via a malformed Collab.collectEmailInfo() call in a crafted PDF. It uses JavaScript obfuscation and heap spraying to achieve remote code execution.
Description
Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with long arguments to unspecified JavaScript methods. NOTE: this issue might be subsumed by CVE-2008-0655.
Exploits (3)
This exploit leverages a buffer overflow in Adobe Reader and Acrobat Professional 8.1.1 via a malformed Collab.collectEmailInfo() call in a crafted PDF. It uses JavaScript obfuscation and heap spraying to achieve remote code execution.
This exploit leverages a heap spray technique to trigger a buffer overflow in Adobe Acrobat/Reader via the `Collab.collectEmailInfo` method, allowing arbitrary code execution. The PoC uses a NOP sled (`%u9090`) and a placeholder shellcode (`%ucccc`).
This Metasploit module exploits a buffer overflow in Adobe Reader/Acrobat 8.1.1 via a malformed Collab.collectEmailInfo() call in a crafted PDF. It generates a PDF with embedded JavaScript to trigger the vulnerability and execute arbitrary shellcode.
References (14)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H