Adobe Reader and Acrobat are prone to an overflow condition. The ACE.dll library fails to properly sanitize user-supplied input resulting in a buffer overflow. With a specially crafted ICC chunk, an attacker can potentially execute arbitrary code.
Classification
Location:
Local / Remote,
Context Dependent
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Solution:
Upgrade
Exploit:
Exploit Private
Disclosure:
Vendor Verified,
Coordinated Disclosure
Solution
Upgrade to Adobe Reader X to version 10.1 or higher, or Adobe Reader and Acrobat to version 9.4.5 or 8.3 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
