CVE-2008-2992
HIGH KEV RANSOMWAREAdobe Acrobat and Reader < 8.1.2 - Remote Code Execution via util.printf Format String
Title source: llmExploitation Summary
CVE-2008-2992 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 3, 2022, with confirmed use in ransomware campaigns.
EIP tracks 7 public exploits from researchers including Metasploit, Debasis Mohanty, Elazar, including a Metasploit module exploits/windows/browser/adobe_utilprintf.
AI-analyzed exploit summary This Metasploit module exploits a buffer overflow in Adobe Reader and Acrobat Professional < 8.1.3 via a malformed util.printf() entry in a crafted PDF file. It generates a PDF with embedded JavaScript that triggers the vulnerability to execute arbitrary code.
Description
Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.
Exploits (7)
This Metasploit module exploits a buffer overflow in Adobe Reader and Acrobat Professional < 8.1.3 via a malformed util.printf() entry in a crafted PDF file. It generates a PDF with embedded JavaScript that triggers the vulnerability to execute arbitrary code.
This Metasploit module exploits a buffer overflow in Adobe Reader and Acrobat Professional < 8.1.3 via a malformed util.printf() entry in a crafted PDF. It delivers a payload through JavaScript embedded in the PDF, leveraging heap spraying and unescape techniques.
This exploit leverages a buffer overflow vulnerability in Adobe Reader's JavaScript `printf` function to execute arbitrary code via a heap spray technique. The payload is a Metasploit-generated bind shell targeting Windows systems.
This exploit targets a stack buffer overflow in Adobe Reader's 'util.printf()' JavaScript function, allowing remote code execution via a maliciously crafted PDF file. The exploit leverages a vulnerability in Adobe Reader versions prior to the 2008-APSB08-19 patch.
This repository contains a functional exploit for CVE-2008-2992, leveraging Metasploit to generate a malicious PDF that exploits Adobe Reader. The automated scripts demonstrate the attack chain, including payload generation, delivery via FTP, and execution on a vulnerable Windows 7 machine.
This Metasploit module exploits a buffer overflow in Adobe Reader/Acrobat via a malformed util.printf() entry in a crafted PDF. It generates a malicious PDF with obfuscated JavaScript to trigger arbitrary code execution.
This Metasploit module exploits a buffer overflow in Adobe Reader/Acrobat < 8.1.3 via a malformed util.printf() entry in a crafted PDF. It generates a malicious PDF file containing obfuscated JavaScript that triggers the vulnerability to execute arbitrary code.
References (28)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H