CVE-2009-1492
EXPLOITEDAdobe Acrobat and Reader 7.0-7.1.1 - Remote Code Execution via getAnnots Doc Method
Title source: llmExploitation Summary
CVE-2009-1492 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Arr1val.
AI-analyzed exploit summary This exploit targets a vulnerability in Adobe Reader 9.1 and 8.1.4 on Linux by leveraging a heap spray technique to overwrite memory with a NOP sled and shellcode, resulting in a bind shell on port 4444. The exploit uses JavaScript embedded in a PDF to trigger the vulnerability via the getAnnots function.
Description
The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that contains an annotation, and has an OpenAction entry with JavaScript code that calls this method with crafted integer arguments.
Exploits (1)
This exploit targets a vulnerability in Adobe Reader 9.1 and 8.1.4 on Linux by leveraging a heap spray technique to overwrite memory with a NOP sled and shellcode, resulting in a bind shell on port 4444. The exploit uses JavaScript embedded in a PDF to trigger the vulnerability via the getAnnots function.