Adobe Reader media.new Player() Analysis (CVE-2009-4324)
Summary: Adobe released an advisory detailing an in-the-wild exploit for Adobe Acrobat, with the bug contained in the doc.media object and triggered by sending a null argument to the newPlayer() method. The in-the-wild sample uses util.printd to allocate an object the same size as the media object in the same spot, so that when the vtable is loaded the printd data is used instead, and once the vtable is controlled a standard JavaScript heapspray can direct the controlled pointer.
What you should know: The exploit is circulating in the wild and the write-up notes the approach does not currently work on machines with DEP on, though techniques exist to circumvent it - so DEP status is the line between blocked and exposed for every Reader install you manage.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2009-4324
- Related
- CVE-2009-4324: Adobe Acrobat and Reader Use-After-Free Vulnerability Known Exploited Vulnerabilities · Jun 08, 2022Matt's Primer for PDF Analysis Cyber Risks ·iPack Exploit Kit Bites Windows Users Cyber Risks ·