Adobe Reader and Acrobat root page node count denial of service
| adobe-root-page-node-dos (19946) |  Medium Risk |
Description:
Adobe Reader is vulnerable to a denial of service attack, caused by a vulnerability when handling an invalid count value in the root page node. An attacker could exploit this vulnerability and cause Adobe to crash by creating a specially-crafted PDF file containing an invalid count value within the root page node.
Consequences:
Denial of Service
Remedy:
For Adobe Reader 7.0:
Upgrade to the latest version (7.0.1 or later), available from the Adobe Download Web page. See References.
For Adobe Reader prior to 7.0:
Upgrade to the latest version (7.0 or later), available from the Adobe Download Web page. See References.
For Adobe Acrobat 7.0:
Upgrade to the latest version (7.0.1 or later), available from the Adobe Download Web page. See References.
For Adobe Acrobat prior to 7.0:
Upgrade to the latest version (7.0 or later), available from the Adobe Download Web page. See References.
References:
- Adobe Download Web page: downloads.
- Adobe Support Knowledgebase Document 331468: Adobe Reader and Adobe Acrobat invalid root page node Count..
- BugTraq Mailing List, 2005-02-18 1:33:22: Adobe Reader invalid root page node Count value DOS.
- CVE-2005-0492: Adobe Acrobat Reader 6.0.3 and 7.0.0 allows remote attackers to cause a denial of service (application crash) via a PDF file that contains a negative Count value in the root page node.
- SA14813: Adobe Reader / Adobe Acrobat Local Files Detection and Denial of Service
- VUPEN/ADV-2005-0310: Adobe Acrobat / Reader DoS and Local File Discovery Vulnerabilities
Platforms Affected:
- Adobe Acrobat Reader 6.0.3
- Adobe Acrobat Reader 7.0
- Apple Mac OS X 10.2
- Apple Mac OS X 10.2.8
- Apple Mac OS X 10.3
Reported:
Apr 01, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net