Exploitation Summary
CVE-2009-4324 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added June 8, 2022.
EIP tracks 5 public exploits from researchers including Metasploit, Ahmed Obied, unknown, hdm, pusscat, jduck, jabra, including a Metasploit module exploits/windows/browser/adobe_media_newplayer.
AI-analyzed exploit summary This exploit leverages a use-after-free vulnerability in Adobe Reader and Acrobat Professional up to version 9.2. It uses JavaScript heap spraying to achieve remote code execution via a maliciously crafted PDF file.
Description
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
Exploits (5)
This exploit leverages a use-after-free vulnerability in Adobe Reader and Acrobat Professional up to version 9.2. It uses JavaScript heap spraying to achieve remote code execution via a maliciously crafted PDF file.
This exploit leverages a use-after-free vulnerability in Adobe Reader and Acrobat Professional up to version 9.2. It employs JavaScript heap spraying and a malformed PDF to achieve remote code execution.
This Python script generates a malicious PDF file exploiting CVE-2009-4324 in Adobe Reader/Acrobat. It uses a heap spray technique and a JavaScript payload to trigger a vulnerability in the `newPlayer` function, executing arbitrary code (calc.exe).
This Metasploit module exploits a use-after-free vulnerability in Adobe Reader and Acrobat Professional up to version 9.2 via a crafted PDF file containing malicious JavaScript. The exploit uses heap spraying and a JavaScript payload to achieve remote code execution.
This Metasploit module exploits a use-after-free vulnerability in Adobe Reader and Acrobat Professional (up to version 9.2) via a crafted PDF file containing malicious JavaScript. The exploit uses heap spraying and a JavaScript payload to achieve remote code execution.
References (22)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H