CVE-2009-0658
HIGH EXPLOITED IN THE WILDAdobe Reader <9.0 - Buffer Overflow
Title source: llmExploitation Summary
CVE-2009-0658 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 6 public exploits from researchers including Metasploit, webDEViL, Guido Landi, including a Metasploit module exploits/windows/browser/adobe_jbig2decode.
AI-analyzed exploit summary This exploit targets a heap-based pointer corruption flaw in Adobe Reader 9.0.0 and earlier via a maliciously crafted PDF file. It uses JavaScript for heap spraying and leverages the JBIG2Decode filter to trigger the vulnerability.
Description
Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as exploited in the wild in February 2009 by Trojan.Pidief.E.
Exploits (6)
This exploit targets a heap-based pointer corruption flaw in Adobe Reader 9.0.0 and earlier via a maliciously crafted PDF file. It uses JavaScript for heap spraying and leverages the JBIG2Decode filter to trigger the vulnerability.
This is a Metasploit module exploiting a heap-based pointer corruption flaw in Adobe Reader 9.0.0 and earlier via a maliciously crafted PDF with embedded JavaScript and JBIG2Decode stream. It uses heap spraying and shellcode execution to achieve remote code execution.
The provided content is a minimal stub referencing a crash at address 41414141, likely indicating a buffer overflow, but lacks executable code or technical details. It points to a PDF (2009-41414141.pdf) hosted on GitLab, which may contain further details.
This exploit generates a malicious PDF file targeting CVE-2009-0658, a JBIG2Decode vulnerability in Adobe Reader. It crafts a PDF with a specially formatted JBIG2 stream to trigger a heap-based buffer overflow.
This Metasploit module exploits a heap-based pointer corruption flaw in Adobe Reader 9.0.0 and earlier via a maliciously crafted PDF with JBIG2Decode stream and JavaScript heap spray. It achieves remote code execution by leveraging a vulnerability in the JBIG2 image decoding process.
This Metasploit module exploits a heap-based pointer corruption flaw in Adobe Reader 9.0.0 and earlier via a maliciously crafted PDF file with embedded JavaScript for heap spraying and a JBIG2Decode stream to trigger memory corruption.
References (26)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H