CVE-2009-0927
Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability
Description
CVE-2009-0927 is a high-severity input validation vulnerability affecting Adobe Reader and Acrobat. Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code. CISA has added CVE-2009-0927 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 93.44% (99.8th percentile), this vulnerability has a very high probability of being exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | acrobat reader | >= 7.0, < 7.1.1; >= 8.0, < 8.1.3; >= 9.0, < 9.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html(Mailing List, Third Party Advisory)
- http://secunia.com/advisories/34490(Third Party Advisory)
- http://secunia.com/advisories/34706(Third Party Advisory)
- http://secunia.com/advisories/34790(Third Party Advisory)
- http://security.gentoo.org/glsa/glsa-200904-17.xml(Third Party Advisory)
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-256788-1(Broken Link)
- http://www.adobe.com/support/security/bulletins/apsb09-04.html(Patch, Vendor Advisory)
- http://www.exploit-db.com/exploits/9579(Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/archive/1/502116/100/0/threaded(Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/34169(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id?1021861(Third Party Advisory, VDB Entry)
- http://www.vupen.com/english/advisories/2009/0770(Third Party Advisory)
- http://www.vupen.com/english/advisories/2009/1019(Third Party Advisory)
- http://www.zerodayinitiative.com/advisories/ZDI-09-014(Third Party Advisory, VDB Entry)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49312(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0927(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
Improper Input Validation is a software weakness where a product receives input or data but does not validate or incorrectly validates that the input has the properties required to process data safely and correctly. This vulnerability occurs when applications accept user-supplied data without verifying that it conforms to expected formats, lengths, types, or ranges. In the case of CVE-2009-0927, this weakness manifests in Adobe Reader and Acrobat where stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2009-0927 represents a significant threat to organizations using Adobe Reader and Acrobat, carrying a CVSS score of 8.8. Successful exploitation can fully compromise the confidentiality, integrity, and availability of affected systems. Attackers can access sensitive data, modify system configurations or data, and disrupt service availability. The network-based attack vector requiring no authentication makes this vulnerability particularly accessible to opportunistic attackers and automated scanning tools.
Exploit Maturity
CVE-2009-0927 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming real-world exploitation. The EPSS score of 93.44% (99.8th percentile) places it among the most likely vulnerabilities to be exploited, reflecting widespread and active exploitation activity. Despite being over 17 years old, this vulnerability continues to be relevant due to the persistence of unpatched legacy systems in production environments.
Remediation
- Apply vendor patches immediately as required by CISA KEV: Apply updates per vendor instructions. Update Adobe Reader and Acrobat to the latest available version that addresses this vulnerability.
- If immediate patching is not possible, restrict network access to the affected Reader and Acrobat service using firewall rules, ACLs, or network segmentation to limit exposure to trusted networks only.
- Monitor affected systems for signs of compromise by reviewing security logs for anomalous activity, unauthorized access attempts, and unexpected system changes related to Reader and Acrobat.
- Evaluate whether affected Adobe Reader and Acrobat deployments are still within vendor support. End-of-life systems should be prioritized for migration to supported alternatives.
- Review and update your organization's vulnerability management process to ensure CISA KEV entries with a remediation deadline of 2022-04-15 are addressed within the required timeframe.
Technical Details
CVE-2009-0927 is classified under CWE-20 (Improper Input Validation) affecting Adobe Reader and Acrobat. Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code. The vulnerability is exploitable remotely over the network, with low attack complexity, requiring no prior authentication, and requiring user interaction such as opening a malicious file or visiting a crafted webpage. The CVSS 3.1 base score of 8.8 (HIGH) reflects high confidentiality impact, high integrity impact, and high availability impact.
Frequently Asked Questions
Is CVE-2009-0927 being actively exploited?
Yes. CVE-2009-0927 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 93.44% (99.8th percentile) indicates a very high probability of exploitation.
What products are affected by CVE-2009-0927?
CVE-2009-0927 primarily affects Adobe Reader and Acrobat, as well as Adobe Acrobat Reader. Organizations should check whether any instances of the affected software are running in their environment.
How do I fix CVE-2009-0927?
Apply updates per vendor instructions. As an interim measure, restrict network access to the affected service to trusted networks only.
How severe is CVE-2009-0927?
CVE-2009-0927 has a CVSS 3.1 score of 8.8, rated HIGH. This high severity rating indicates significant potential impact on affected systems. The inclusion in the CISA KEV catalog means organizations are required to remediate this vulnerability within the specified deadline.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.