Vulnerability Note VU#25919

Adobe Acrobat ActiveX Control buffer overflow in setview method

Overview

I. Description

The Adobe Acrobat ActiveX control has a buffer overflow in the setview method. Because the control is marked safe-for-scripting, this vulnerability can be exploited via a web page if the user has the vulnerable control installed.

This control is implemtned in the file pdf.ocx and has a ClassID of {CA8A9780-280D-11CF-A24D-444553540000}. The control can also be referenced as PDF.PdfCtrl.1.

II. Impact

An attacker may exploit the buffer overflow to execute arbitrary commands on the system running the vulnerable control. Because the control is marked safe-for-scripting, an attacker may be able to launch this attack when you visit a web page.

III. Solution

Upgrade to a newer version of Adobe Acrobat

This problem appears to be limited to version 1.3.188 of Adobe Acrobat and earlier.

Systems Affected

Vendor	Status	Date Updated
Adobe	Vulnerable	2-Nov-2000

References

http://www.tiac.net/users/smiths/acctroj/buffovf.htm

Credit

This document was written by Cory F Cohen.

Other Information

Date Public	09/30/1999
Date First Published	11/02/2000 06:07:01 PM
Date Last Updated	11/02/2000
CERT Advisory
CVE Name
Metric	16.83
Document Revision	4

If you have feedback, comments, or additional information about this vulnerability, please send us email.