リモートホストにインストールされている Adobe PDF プラグインのバージョンは、8.0 / 7.0.9 / 6.0.6 より前であり、報告されているところによれば、「オープンパラメータ」機能で使用される「FDF」、「XML」、または「XFDF」フィールドへの入力を適切にサニタイズできません。ユーザーをトリックにかけて、特別に作り上げられたリンクにアクセスさせることで、プラグインを使用するブラウザに応じて、リモートの攻撃者は、これらの問題を利用して、リモートホスト上のユーザーに対して、任意のコードの実行、サービス拒否、クロスサイトスクリプトの偽造、またはクロスサイトスクリプティング攻撃を実行できることがあります。

远程主机上安装的 Adobe PDF 插件版本低于 8.0 / 7.0.9 / 6.0.6，有报告称其无法正确清除由其“打开参数”功能输入到“FDF”、“XML”或“XFDF”字段中的内容。通过欺骗用户访问特别构建的链接，根据使用插件的浏览器，远程攻击者可能会利用这些问题执行针对远程主机上用户的任意代码执行、拒绝服务、跨站脚本伪造或跨站脚本攻击。

The version of Adobe Acrobat installed on the remote host is earlier than 6.0.6 / 7.0.9 / 8.0 and thus reportedly is affected by several security issues, including one that can lead to arbitrary code execution when processing a malicious PDF file.

The version of Adobe Reader installed on the remote host is earlier than 7.0.9 / 8.0 and is, therefore, reportedly affected by several security issues, including one that can lead to arbitrary code execution when processing a malicious PDF file.

The version of Adobe PDF Plug-In installed on the remote host is earlier than 8.0 / 7.0.9 / 6.0.6 and reportedly fails to properly sanitize input to the 'FDF', 'XML', or 'XFDF' fields used by its 'Open Parameters' feature. By tricking a user into accessing a specially crafted link and depending on the browser with which the plugin is used, a remote attacker may be able to leverage these issues to conduct arbitrary code execution, denial of service, cross-site script forgery, or cross-site scripting attacks against a user on the remote host.

The Adobe Acrobat Reader has been updated to version 7.0.9.

This update also includes following security fixes :

CVE-2006-5857: A memory corruption problem was fixed in Adobe Acrobat Reader can potentially lead to code execution.

CVE-2007-0044: Universal Cross Site Request Forgery (CSRF) problems were fixed in the Acrobat Reader plugin which could be exploited by remote attackers to conduct CSRF attacks using any site that is providing PDFs.

CVE-2007-0045: Cross site scripting problems in the Acrobat Reader plugin were fixed, which could be exploited by remote attackers to conduct XSS attacks against any site that is providing PDFs.

CVE-2007-0046: A double free problem in the Acrobat Reader plugin was fixed which could be used by remote attackers to potentially execute arbitrary code. Note that all platforms using Adobe Reader currently have counter measures against such attack where it will just cause a controlled abort().

CVE-2007-0047 and CVE-2007-0048 affect only Microsoft Windows and Internet Explorer.

ID	名稱	產品	系列	已發布	已更新	嚴重性
23975	Adobe PDF プラグイン < 8.0 / 7.0.9 / 6.0.6 の複数の脆弱性（APSB07-01）	Nessus	Windows	2007/1/5	2018/11/15	high
23975	Adobe PDF 插件 < 8.0 / 7.0.9 / 6.0.6 多个漏洞 (APSB07-01)	Nessus	Windows	2007/1/5	2018/11/15	high
40798	Adobe Acrobat < 6.0.6 / 7.0.9 Multiple Vulnerabilities	Nessus	Windows	2009/8/28	2024/5/31	high
24002	Adobe Reader < 6.0.6 / 7.0.9 Multiple Vulnerabilities	Nessus	Windows	2007/1/10	2018/11/15	high
23975	Adobe PDF Plug-In < 8.0 / 7.0.9 / 6.0.6 Multiple Vulnerabilities (APSB07-01)	Nessus	Windows	2007/1/5	2018/11/15	high
27144	openSUSE 10 Security Update : acroread (acroread-2506)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	high

偵測

搜尋 Plugin

high

high

high

high

high

high