CVE-2009-1862
Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability
Description
CVE-2009-1862 is an unspecified vulnerability affecting both Adobe Acrobat/Reader and Adobe Flash Player that allows remote attackers to execute arbitrary code or cause a denial of service. The flaw can be exploited through malicious Flash content served via web pages or through SWF content embedded in PDF documents, providing attackers with multiple exploitation vectors. CISA has added CVE-2009-1862 to its Known Exploited Vulnerabilities catalog, confirming active exploitation. With an EPSS score of 58.6% (98th percentile), this vulnerability has a significant probability of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | acrobat | >= 9.0, <= 9.1.2 |
| adobe | acrobat reader | >= 9.0, <= 9.1.2 |
| adobe | flash player | >= 9.0, <= 9.0.159.0; >= 10.0, <= 10.0.22.87 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://blogs.adobe.com/psirt/2009/07/potential_adobe_reader_and_fla.html(Broken Link, Vendor Advisory)
- http://bugs.adobe.com/jira/browse/FP-1265(Broken Link)
- http://isc.sans.org/diary.html?storyid=6847(Not Applicable)
- http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html(Mailing List, Third Party Advisory)
- http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html(Mailing List, Third Party Advisory)
- http://news.cnet.com/8301-27080_3-10293389-245.html(Broken Link)
- http://secunia.com/advisories/36193(Broken Link)
- http://secunia.com/advisories/36374(Broken Link)
- http://secunia.com/advisories/36701(Broken Link)
- http://security.gentoo.org/glsa/glsa-200908-04.xml(Third Party Advisory)
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1(Broken Link)
- http://support.apple.com/kb/HT3864(Third Party Advisory)
- http://support.apple.com/kb/HT3865(Third Party Advisory)
- http://www.adobe.com/support/security/advisories/apsa09-03.html(Vendor Advisory)
- http://www.adobe.com/support/security/bulletins/apsb09-10.html(Not Applicable)
- http://www.adobe.com/support/security/bulletins/apsb09-13.html(Not Applicable)
- http://www.kb.cert.org/vuls/id/259425(Third Party Advisory, US Government Resource)
- http://www.securityfocus.com/bid/35759(Broken Link, Third Party Advisory, VDB Entry)
- http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-072209-2512-99(Broken Link)
- http://www.symantec.com/connect/blogs/next-generation-flash-vulnerability(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1862(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2009-1862 is associated with improper memory handling in both Adobe Flash Player and the Flash rendering components of Adobe Acrobat and Reader. Though the specific mechanism was not fully disclosed, the vulnerability allows crafted content to corrupt memory beyond intended buffer boundaries, enabling arbitrary code execution or denial of service.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2009-1862 is remotely exploitable through two distinct attack vectors: malicious web pages containing Flash content, and PDF documents with embedded SWF objects. No authentication is required, and user interaction is limited to visiting a page or opening a document. Successful exploitation enables arbitrary code execution with the privileges of the affected application, placing confidentiality, integrity, and availability at full risk. The dual-product nature of this vulnerability — affecting both Flash Player and Adobe Reader — significantly expands the attack surface. The EPSS score of 58.6% (98th percentile) indicates a high probability of exploitation, and Flash Player's end-of-life status means one attack vector will never be patched.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2009-1862 in the wild by adding it to the Known Exploited Vulnerabilities catalog on June 8, 2022. The EPSS score of 58.6% places this vulnerability in the 98th percentile, indicating significant exploitation activity. CVE-2009-1862 was exploited as a zero-day vulnerability affecting both Adobe Flash Player and Adobe Acrobat/Reader simultaneously, demonstrating its versatility as an attack vector. The CISA required action differentiates between the two products: for Adobe Acrobat and Reader, apply updates per vendor instructions; for Adobe Flash Player, the product is end-of-life and should be disconnected. No specific ransomware association has been reported.
Remediation
- Remove Adobe Flash Player entirely: Flash Player is end-of-life and should be completely uninstalled from all systems, as the Flash Player attack vector will never receive a patch.
- Apply Adobe security updates for Acrobat and Reader: Install the latest patches for Adobe Acrobat and Reader to address the vulnerability in the SWF rendering component within PDF documents.
- Disable Flash content rendering in PDF readers: Configure Adobe Reader to block the execution of embedded Flash (SWF) content within PDF documents, eliminating the PDF-based attack vector.
- Block Flash content at all network entry points: Configure email gateways, web proxies, and firewalls to block SWF files, both standalone and embedded within PDF documents or other containers.
- Monitor for multi-vector exploitation attempts: Deploy endpoint detection capabilities that monitor for both web-based Flash exploitation and PDF-embedded Flash attacks, as this vulnerability can be delivered through either vector.
Technical Details
CVE-2009-1862 is a vulnerability that uniquely affects both Adobe Flash Player and the Flash rendering component within Adobe Acrobat and Reader. The specific technical details were not fully disclosed by Adobe, but the vulnerability is associated with improper memory handling (CWE-119) during Flash content processing. The dual-product nature of this vulnerability means it can be triggered through two distinct paths: directly via malicious SWF content in a web page rendered by Flash Player, or indirectly via SWF content embedded within a PDF document rendered by Adobe Reader's built-in Flash interpreter. This dual attack surface made the vulnerability particularly valuable, as attackers could choose between web-based delivery for mass exploitation or PDF-based delivery for targeted spear-phishing campaigns, depending on their objectives.
Frequently Asked Questions
Is CVE-2009-1862 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2009-1862 to the Known Exploited Vulnerabilities catalog. The EPSS score of 58.6% in the 98th percentile indicates significant exploitation activity. The vulnerability was used in zero-day attacks targeting both Flash Player and Adobe Reader.
What products are affected by CVE-2009-1862?
CVE-2009-1862 affects both Adobe Acrobat/Reader and Adobe Flash Player. The Flash Player component has reached end-of-life, while Adobe Acrobat and Reader require patching to the latest supported version.
How do I fix CVE-2009-1862?
Remove Adobe Flash Player entirely (end-of-life). For Adobe Acrobat and Reader, apply the latest security updates and disable Flash content rendering within PDF documents.
How severe is CVE-2009-1862?
CVE-2009-1862 is a severe vulnerability affecting two Adobe products simultaneously, with an EPSS score in the 98th percentile. The dual attack surface through both web-based Flash content and PDF-embedded Flash makes this vulnerability exceptionally versatile for attackers.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.