=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2009/VULN181
_____________________________________________________________________

DATE                      : 14/05/2009

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running Adobe Reader and Adobe Acrobat.

======================================================================
http://www.adobe.com/support/security/bulletins/apsb09-06.html
______________________________________________________________________
Security Updates available for Adobe Reader and Acrobat

Release date: May 12, 2009

Vulnerability identifier: APSB09-06

CVE number: CVE-2009-1492, CVE-2009-1493

Platform: All Platforms

Summary

A critical vulnerability has been identified in Adobe Reader 9.1 and
Acrobat 9.1 and earlier versions. This vulnerability (CVE-2009-1492)
would cause the application to crash and could potentially allow an
attacker to take control of the affected system.  A second vulnerability
has also been reported that appears to affect Adobe Reader for UNIX only
(CVE-2009-1493).

Adobe recommends users of Adobe Reader 9.1 and Acrobat 9.1 and earlier
versions update to Adobe Reader 9.1.1 and Acrobat 9.1.1. Adobe recommends
users of Acrobat 8 update to Acrobat 8.1.5, and users of Acrobat 7 update
to Acrobat 7.1.2. For Adobe Reader users who cant update to Adobe Reader
9.1.1, Adobe has provided the Adobe Reader 8.1.5 and Adobe Reader 7.1.2
updates.

Affected software versions

Adobe Reader 9.1 and earlier versions.
Adobe Acrobat Standard, Pro, and Pro Extended 9.1 and earlier versions.

Solution

Adobe Reader

Adobe Reader users on Windows can find the appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows.

Adobe Reader users on Macintosh can find the appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Macintosh.

Adobe Reader users on UNIX can find the appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Unix.

Acrobat

Acrobat Standard, Pro and Pro Extended users on Windows can find the
appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Window.

Acrobat 3D users on Windows can find the appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=112&platform=Windows.

Acrobat Pro users on Macintosh can find the appropriate update here:
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh.

Severity rating

Adobe categorizes this as a critical update and recommends that users
apply the update for their product installations.

Details

A critical vulnerability has been identified in Adobe Reader 9.1 and
Acrobat 9.1 and earlier versions. This vulnerability (CVE-2009-1492)
would cause the application to crash and could potentially allow an
attacker to take control of the affected system.  A second
vulnerability has also been reported that appears to affect Adobe
Reader for UNIX only (CVE-2009-1493).  These issues are remotely
exploitable.

Adobe recommends users of Acrobat and Adobe Reader update their
product installations to versions 9.1.1, 8.1.5, or 7.1.2 using the
instructions above to protect themselves from potential
vulnerabilities.  Adobe expects to make available Adobe Reader 7
and Acrobat 7 updates for Macintosh before the end of June.  This
document will be updated to specify the expected date of these
updates once available.

======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================