Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Protection against Adobe Reader and Acrobat Doc.media.newPlayer Memory Corruption Vulnerability (APSA09-07)

Subscribe

Check Point Reference: CPAI-2009-295
Date Published:
Preemptive Since:
Severity:
Source: Adobe Security Bulletin - APSA09-07
Industry Reference(s): CVE-2009-4324
Protection Provided by: Security Gateway
  • R70
VPN-1
  • NGX R65
VSX
  • NGX R65
InterSpect
  • NGX
Who is Vulnerable?
Adobe Reader 9.2 and earlier versions for Windows, Macintosh, and UNIX
Adobe Acrobat 9.2 and earlier versions for Windows and Macintosh
Vulnerability Description
A memory corruption vulnerability has been reported in Adobe Reader and Acrobat. A remote attacker can exploit this vulnerability to execute arbitrary code on an affected system via a specially crafted PDF file. Portable Document Format (PDF) is an open file format created by Adobe Systems. It is used for representing two-dimensional documents in a device and resolution independent fixed-layout document format. Successful exploitation allows execution of arbitrary code on a vulnerable system.
Update/Patch Available
Apply patches:
Adobe Security Bulletin - APSA09-07
Vulnerability Details
The vulnerability is due to an error in the implementation of the Doc.media.newPlayer JavaScript method in Adobe Reader and Acrobat. A remote attacker could trigger this flaw via a specially crafted PDF file containing the vulnerable JavaScript method. Successful exploitation allows execution of arbitrary code once a malicious PDF file is loaded on a vulnerable system.

Protection Overview
This protection detects and blocks any attempt to transfer over HTTP PDF files that contain embedded JavaScript. No update is required to address this vulnerability.

Users are protected against this vulnerability if the Protection against PDF Containing Embedded JavaScript Files addressed in SBP-2008-02 has been applied.

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway R70

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Application Intelligence > Content Protection .
2. In the right pane, double-click the Multiple Products PDF Containing Embedded Javascript Integer Overflow protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Content Protection Violation
Attack Information: PDF containing embedded JavaScript file detected

VPN-1 NGX R65 & VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > Content Protection > Block PDF Containing Embedded JavaScript Files.
2. In the configuration pane, under Settings > Mode, check Active.
3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Content Protection Violation
Attack Information: PDF containing embedded JavaScript file detected

InterSpect NGX

How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the SmartDefense page of the profile.
2. In the SmartDefense tree, click Application Intelligence > Content Protection and enable Block PDF Containing Embedded JavaScript Files.
3. Install security policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Content Protection Violation
Attack Information: PDF containing embedded JavaScript file detected