Adobe Acrobat Reader Plugin PDF cross-site request forgery

adobe-acrobat-pdf-csrf (31266) The risk level is classified as HighHigh Risk


The Adobe Acrobat Reader Plugin is vulnerable to a cross-site request forgery, caused by improper validation of input passed to PDF documents. A remote attacker could exploit this vulnerability using the FDF, XML, or XFDF parameter in a specially-crafted URL to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities, if the attacker could persuade the victim to click the URL.

In certain Adobe versions and browser settings, this vulnerability could allow remote code execution.


Base Score: 8
  Access Vector: Remote
  Access Complexity: High
  Authentication: Not Required
  Confidentiality Impact: Complete
  Integrity Impact: Complete
  Availability Impact: Complete
Temporal Score: 5.9
  Exploitability: Unproven
  Remediation Level: Official-Fix
  Report Confidence: Confirmed


Gain Access


Upgrade to the latest version of the Adobe Acrobat Reader Plugin (8.0.0 or later), available from the Adobe Acrobat Reader Plugin Web site. See References.

For SUSE Linux (Acrobat Reader):
Refer to SUSE-SA:2007:011 for patch, upgrade, or suggested workaround information. See References.

For other distributions:
Contact your vendor for upgrade or patch information.


  • Adobe Acrobat Reader Plugin Web site: Adobe - Reader.
  • Full-Disclosure Mailing List, Wed Jan 03 2007 - 11:22:49 CST: Adobe Acrobat Reader Plugin - Multiple Vulnerabilities.
  • ASA-2008-092: acroread security update (RHSA-2008-0144)
  • BID-21858: Adobe Reader Plugin Open Parameters Cross-Site Scripting Vulnerability
  • CVE-2007-0044: Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka Universal CSRF and session riding.
  • GLSA-200701-16: Adobe Acrobat Reader: Multiple vulnerabilities
  • RHSA-2008-0144: Critical: acroread security update
  • SECTRACK ID: 1017469: Adobe Acrobat Reader Plugin Bugs Let Remote Users Deny Service, Conduct Cross-Site Scripting Attacks, and Execute Arbitrary Code
  • SUSE-SA:2007:011: Acrobat Reader 7.0.9 update

Platforms Affected:

  • Adobe Acrobat 7.0 Standard
  • Adobe Acrobat 7.0 Professional
  • Adobe Acrobat 7.0.1 Professional
  • Adobe Acrobat 7.0.1 Standard
  • Adobe Acrobat 7.0.2 Standard
  • Adobe Acrobat 7.0.2 Professional
  • Adobe Acrobat 7.0.3 Professional
  • Adobe Acrobat 7.0.3 Standard
  • Adobe Acrobat 7.0.4 Professional
  • Adobe Acrobat 7.0.4 Standard
  • Adobe Acrobat 7.0.5 Professional
  • Adobe Acrobat 7.0.5 Standard
  • Adobe Acrobat 7.0.6 Standard
  • Adobe Acrobat 7.0.6 Professional
  • Adobe Acrobat 7.0.7 Standard
  • Adobe Acrobat 7.0.7 Professional
  • Adobe Acrobat 7.0.8 Professional
  • Adobe Acrobat 7.0.8 Standard
  • Adobe Acrobat 3D
  • Adobe Acrobat Elements 7.0.8
  • Adobe Acrobat Reader 6.0
  • Adobe Acrobat Reader 6.0.1
  • Adobe Acrobat Reader 6.0.2
  • Adobe Acrobat Reader 6.0.3
  • Adobe Acrobat Reader 6.0.4
  • Adobe Acrobat Reader 6.0.5
  • Adobe Acrobat Reader 7.0
  • Adobe Acrobat Reader 7.0.1
  • Adobe Acrobat Reader 7.0.2
  • Adobe Acrobat Reader 7.0.3
  • Adobe Acrobat Reader 7.0.4
  • Adobe Acrobat Reader 7.0.5
  • Adobe Acrobat Reader 7.0.6
  • Adobe Acrobat Reader 7.0.7
  • Adobe Acrobat Reader 7.0.8
  • Adobe Acrobat Reader Plugin 7.0.8
  • Gentoo Linux
  • Novell Linux Desktop 9
  • Novell OpenSUSE 10.2
  • RedHat RHEL Desktop Supplementary 5 Client
  • RedHat RHEL Extras 3
  • RedHat RHEL Extras 4
  • RedHat RHEL Extras 4.6.z
  • RedHat RHEL Supplementary 5 Server
  • RedHat RHEL Supplementary 5.1.z EUS
  • SuSE Linux Enterprise Server 8
  • SUSE SuSE Linux 10.0
  • SUSE SuSE Linux 10.1
  • SUSE SuSE Linux 9.3
  • SuSE SuSE SLED 10
  • SuSE SuSE SLES 9


Jan 03, 2007

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this

Return to the main page