—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Liebe Kolleginnen und Kollegen,

soeben erreichte uns nachfolgende Warnung. Wir geben diese Informationen
unveraendert an Sie weiter.

CVE-2010-0190 – Cross-Site-Scripting-Schwachstelle in Adobe Reader und
Acrobat

Eine nicht naeher beschriebene Schwachstelle in Adobe Reader und
Acrobat kann von einem Angreifer fuer eine Cross-Site-Scripting-Attacke
ausgenutzt werden, die die Ausfuehrung beliebigen Codes mit den Rechten
des angemeldeten Benutzers ermoeglicht.

CVE-2010-0192 / CVE-2010-0193 / CVE-2010-0196 – DoS-Schwachstellen in
Adobe Reader und Acrobat

Mehrere Schwachstellen in Adobe Reader und Acrobat ermoeglichen einem
Angreifer, Denial-of-Service-Angriffe (DoS) durchzufuehren.
Moeglicherweise laesst sich hierueber auch beliebiger Code mit den
Rechten des angemeldeten Benutzers ausfuehren.

CVE-2010-1241 – Heap-Overflow in CoolType.dll von Adobe Reader und
Acrobat

Ein Heap-Overflow in CoolType.dll von Adobe Reader und Acrobat bei der
Verarbeitung von CFF-kodierten Fonts ermoeglicht einem Angreifer,
beliebigen Code mit den Rechten des angemeldeten Benutzers auszufuehren.

CVE-2010-0194 – Korrumpierter Speicher in X3D-Komponente von Adobe
Reader und Acrobat

Ein Fehler in der X3D-Komponente (3difr.x3d) von Adobe Reader und
Acrobat bei der Verarbeitung von DeviceRGB-Streams kann ausgenutzt
werden, um den Speicher zu korrumpieren und beliebigen Code mit den
Rechten des angemeldeten Benutzers auszufuehren.

CVE-2010-0197 / CVE-2010-0198 / CVE-2010-0199 / CVE-2010-0201 /
CVE-2010-0202 / CVE-2010-0203 / CVE-2010-0204 – Buffer-Overflows und
Fehler in Speicherstrukturen in Adobe Reader und Acrobat

Mehrere nicht naeher spezifizierte Schwachstellen in Adobe Reader und
Acrobat fuehren zu Buffer-Overflows und zur Korrumpierung von
Speicherstrukturen. Ein Angreifer kann diese ausnutzen, um beliebigen
Code mit den Rechten des angemeldeten Benutzers auszufuehren.

CVE-2010-0191 – “prefix protocol handler”-Schwachstelle in Adobe Reader
und Acrobat

Eine Schwachstelle in Zusammenhang mit einem “prefix protocol handler”
in Adobe Reader und Acrobat kann fuer Angriffe ausgenutzt werden, die
die Ausfuehrung beliebigen Codes mit den Rechten des angemeldeten
Benutzers ermoeglichen.

CVE-2010-0195 – Fehlerhafte Array-Indizierung in Adobe Reader und
Acrobat

Ein Fehler in Adobe Reader und Acrobat bei der Verarbeitung von Fonts,
die in ein PDF-Dokument eingebettet sind, ermoeglicht die Ausfuehrung
beliebigen Codes mit den Rechten des angemeldeten Benutzers. Bei der
Verarbeitung werden Indices falsch berechnet, die dazu fuehren, das
Daten in falsche Speicherbereiche kopiert werden.

Betroffen sind die folgenden Software Pakete und Plattformen:

Adobe Reader und Acrobat 9.3.x vor 9.3.2 und 8.2.x vor 8.2.2

Alle Plattformen auf denen Adobe Reader und Acrobat laeuft.

Vom Hersteller werden ueberarbeitete Pakete zur Verfuegung gestellt.

Hersteller Advisory:
http://www.adobe.com/support/security/bulletins/apsb10-09.html

(c) der deutschen Zusammenfassung bei DFN-CERT Services GmbH; die
Verbreitung, auch auszugsweise, ist nur unter Hinweis auf den Urheber,
DFN-CERT Services GmbH, und nur zu nicht kommerziellen Zwecken
gestattet.

Mit freundlichen Gruessen,
Christian Keil

– —
Dr.-Ing. Christian Keil (Senior Researcher)
DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-590
Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737
Sachsenstrasse 5, 20097 Hamburg/Germany, CEO: Dr. Klaus-Peter Kossakowski

Automatische Warnmeldungen https://www.cert.dfn.de/autowarn

Security update available for Adobe Reader and Acrobat

Release date: April 13, 2010

Vulnerability identifier: APSB10-09

CVE numbers: CVE-2010-0190, CVE-2010-0191, CVE-2010-0192, CVE-2010-0193, CVE-2010-0194, CVE-2010-0195, CVE-2010-0196, CVE-2010-0197, CVE-2010-0198, CVE-2010-0199, CVE-2010-0201, CVE-2010-0202, CVE-2010-0203, CVE-2010-0204, CVE-2010-1241

Platform: All Platforms
Summary

Critical vulnerabilities have been identified in Adobe Reader 9.3.1 (and earlier versions) for Windows, Macintosh, and UNIX, Adobe Acrobat 9.3.1 (and earlier versions) for Windows and Macintosh, and Adobe Reader 8.2.1 (and earlier versions) and Adobe Acrobat 8.2.1 (and earlier versions) for Windows and Macintosh. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system.

Adobe recommends users of Adobe Reader 9.3.1 and earlier versions for Windows, Macintosh and UNIX update to Adobe Reader 9.3.2. (For Adobe Reader users on Windows and Macintosh, who cannot update to Adobe Reader 9.3.2, Adobe has provided the Adobe Reader 8.2.2 update.) Adobe recommends users of Adobe Acrobat 9.3.1 and earlier versions for Windows and Macintosh update to Adobe Acrobat 9.3.2. Adobe recommends users of Acrobat 8.2.1 and earlier versions for Windows and Macintosh update to Acrobat 8.2.2.
Affected software versions

Adobe Reader 9.3.1 and earlier versions for Windows, Macintosh, and UNIX
Adobe Acrobat 9.3.1 and earlier versions for Windows and Macintosh
Solution

Adobe Reader
Users can utilize the product’s automatic update feature. The default installation configuration runs automatic updates on a regular schedule and can be manually activated by choosing Help > Check for Updates.

Adobe Reader users on Windows can also find the appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows.

Adobe Reader users on Macintosh can also find the appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Macintosh.

Adobe Reader users on UNIX can find the appropriate update here:
http://get.adobe.com/reader/.

Adobe Acrobat
Users can utilize the product’s automatic update feature. The default installation configuration runs automatic updates on a regular schedule and can be manually activated by choosing Help > Check for Updates.

Acrobat Standard and Pro users on Windows can also find the appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows.

Acrobat Pro Extended users on Windows can also find the appropriate update here: http://www.adobe.com/support/downloads/product.jsp?product=158&platform=Windows.

Acrobat 3D users on Windows can also find the appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=112&platform=Windows.

Acrobat Pro users on Macintosh can also find the appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh.
Severity rating

Adobe categorizes these as critical updates and recommends that users apply the latest updates for their product installations.
Details

Critical vulnerabilities have been identified in Adobe Reader 9.3.1 (and earlier versions) for Windows, Macintosh, and UNIX, Adobe Acrobat 9.3.1 (and earlier versions) for Windows and Macintosh, and Adobe Reader 8.2.1 (and earlier versions) and Adobe Acrobat 8.2.1 (and earlier versions) for Windows and Macintosh. These vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system.

Adobe recommends users of Adobe Reader 9.3.1 and earlier versions for Windows, Macintosh and UNIX update to Adobe Reader 9.3.2. (For Adobe Reader users on Windows and Macintosh, who cannot update to Adobe Reader 9.3.2, Adobe has provided the Adobe Reader 8.2.2 update.) Adobe recommends users of Adobe Acrobat 9.3.1 and earlier versions for Windows and Macintosh update to Adobe Acrobat 9.3.2. Adobe recommends users of Acrobat 8.2.1 and earlier versions for Windows and Macintosh update to Acrobat 8.2.2.

This update resolves a cross-site scripting vulnerability that could lead to code execution (CVE-2010-0190).

This update resolves a prefix protocol handler vulnerability that could lead to code execution (CVE-2010-0191).

This update resolves a denial of service vulnerability; arbitrary code execution has not been demonstrated, but may be possible (CVE-2010-0192).

This update resolves a denial of service vulnerability; arbitrary code execution has not been demonstrated, but may be possible (CVE-2010-0193).

This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-0194).

This update resolves a font handling vulnerability that could lead to code execution (CVE-2010-0195).

This update resolves a denial of service vulnerability; arbitrary code execution has not been demonstrated, but may be possible (CVE-2010-0196).

This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-0197).

This update resolves a buffer overflow vulnerability that could lead to code execution (CVE-2010-0198).

This update resolves a buffer overflow vulnerability that could lead to code execution (CVE-2010-0199).

This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-0201).

This update resolves a buffer overflow vulnerability that could lead to code execution (CVE-2010-0202).

This update resolves a buffer overflow vulnerability that could lead to code execution (CVE-2010-0203).

This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2010-0204).

This update resolves a heap-based overflow vulnerability that could lead to code execution (CVE-2010-1241).
Acknowledgements

Adobe would like to thank the following individuals and organizations for reporting the relevant issues and for working with Adobe to help protect our customers:

* Billy Rios and Microsoft Vulnerability Research (MSVR) (CVE-2010-0190, CVE-2010-0191)
* Aki Helin of Oulu University Secure Programming Group (CVE-2010-0192)
* Microsoft Vulnerability Research Program (MSVR) (CVE-2010-0193)
* Bing Liu of Fortinet’s FortiGuard Labs (CVE-2010-0194)
* An anonymous researcher reported through TippingPoint?s Zero Day Initiative (CVE-2010-0195)
* Vulnerability Research Team, TELUS Security Labs (CVE-2010-0196)
* James Quirk of Los Alamos, New Mexico (CVE-2010-0197)
* Nicolas Joly of VUPEN Vulnerability Research Team (CVE-2010-0198, CVE-2010-0199, CVE-2010-0202, CVE-2010-0203)
* Felipe Andres Manzano through the iSIGHT Partners Global Vulnerability Partnership (CVE-2010-0201)
* Greg MacManus of iSIGHT Partners Labs (CVE-2010-0204)
* Haifei Li of Fortinet’s FortiGuard Labs (CVE-2010-1241)

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFLxehBWmhIvjFb90URArtGAJ4o7sUdMg33b9+ViAFmNek1iJ9KOgCeMVOA
TXwyeSyqfG/rrBBpoZxInkg=
=2WVO
—–END PGP SIGNATURE—–