# MA-257.112010: MyCERT Advisory - Multiple Critical Vulnerabilities in Adobe Reader

**Date:** 06 Nov 2010  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-257.112010  
**Advisory ID:** MA-257.112010

---

1.0 Introduction
A critical vulnerability has been identified in Adobe Reader 9.4 and earlier. This vulnerability could cause the application to crash and could potentially execute arbitrary code on the affected system.
This issue is caused by a use-after-free error in the "printSeps()" JavaScript function when processing a PDF.
2.0 Impact
MyCERT is aware that a POC is being available in the Internet, but at the time of writing this advisory, it will only cause a Denial of Service. Arbitrary code execution has not been demonstrated, but may be possible. [1]
3.0 Affected Products
Majority of the Adobe Reader versions are prone to this vulnerability. Below is the list of vulnerable products:
- Adobe Reader 9.4 and earlier
4.0 Recommendation
At the time of this writing, Adobe has not released any patches to address this vulnerability. However, users can use the following steps as a temporary workaround:
4.1    Disable the JavaScript support for Adobe Reader and Adobe Acrobat. JavaScript can be disabled by doing the followings:
a)    Disable JavaScript in Adobe Acrobat and Adobe Reader
1.    Open Your Adobe Acrobat or Adobe Reader software
2.    Navigate to Edit -> Preferences -> JavaScript
3.    Select ‘uncheck’ the Enable Acrobat JavaScript.
Close the Adobe Acrobat or Adobe Reader Software for change to take effect.
4.2    Windows users are also advised to enable Data Execution Prevention (DEP) on the Windows
- For Windows XP
- Log in as administrator
- Open the Start menu, right-click on My Computer and Choose “Properties” from the context menu
- On the “System Properties” window, click the “Advanced” tab
- - Click settings button under Performance
- - Click the “Data Execution Prevention” tab
- - Choose “Turn on DEP for all programs and services except those I select:”
- - Click OK twice
- - Restart the computer for the changes to take effect
- Windows Vista
- - Log in as administrator
- - Open the Start menu and right-click “Computer”
- Choose “Properties” from the context menu.
- - Choose “Advanced system settings” from under “Tasks” in the left pane.
- - Approve the User Account Control query (You will have to be an administrator to do it).
- - Click the button “Settings” in the Performance section.
- - Click the tab “Data Execution Prevention”
- - Choose “Turn on DEP for all programs and services except those I select:”
- - Click OK twice
- - Restart the computer for the changes to take effect
4.3    As for the enterprise environment, deploying the Enhanced Mitigation Experience Toolkit is advised.
- Enhanced Mitigation Experience Toolkit (EMET) is a utility that helps prevent vulnerabilities in software from successfully being exploited by applying in-box mitigations such as DEP to applications configured in EMET. For more information, see http://support.microsoft.com/kb/2458544
Users are also recommended to browse the Internet with least privilege user to limit the execution of the malicious file and do not open attachment or browse to unknown website received via email from unknown person or unexpected.
MyCERT advises users of the products mentioned in this advisory to keep themselves updated with the latest security announcements from the products’ vendor. MyCERT can be reached through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: https://www.mycert.org.my
5.0 References
- http://blogs.adobe.com/psirt/2010/11/potential-issue-in-adobe-reader.html
- https://gallus.honeynet.org.my/gallus/upload/reanalyze?exist\_md5sum=d000e74163e34fc65914676674776284&xmlOnly=false