CVE-2009-2993

Adobe Acrobat and Reader < 9.2 - Arbitrary File Write via JavaScript API cPath Parameter

Title source: llm

Description

The JavaScript for Acrobat API in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 does not properly implement the (1) Privileged Context and (2) Safe Path restrictions for unspecified JavaScript methods, which allows remote attackers to create arbitrary files, and possibly execute arbitrary code, via the cPath parameter in a crafted PDF file. NOTE: some of these details are obtained from third party information.

References (8)

Core 8

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/36638

Patch, US Government Resource third-party-advisory x_refsource_cert

http://www.us-cert.gov/cas/techalerts/TA09-286B.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1023007

Patch, Vendor Advisory x_refsource_confirm

http://www.adobe.com/support/security/bulletins/apsb09-15.html

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5822

Patch, Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/2898

Patch, US Government Resource third-party-advisory x_refsource_cert-vn

http://www.kb.cert.org/vuls/id/257117

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/36664

Scores

EPSS 0.0667

EPSS Percentile 93.1%

Details

CWE

CWE-20

Status published

Products (50)

adobe/acrobat 7.0

adobe/acrobat 7.0.1

adobe/acrobat 7.0.2

adobe/acrobat 7.0.3

adobe/acrobat 7.0.4

adobe/acrobat 7.0.5

adobe/acrobat 7.0.6

adobe/acrobat 7.0.7

adobe/acrobat 7.0.8

adobe/acrobat 7.0.9

... and 40 more

Published Oct 19, 2009

Tracked Since Feb 18, 2026