Vulnerability Details : CVE-2009-3953
Public exploit exists!
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
Vulnerability category: OverflowExecute code
CVE-2009-3953 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.
Added on
2022-06-08
Action due date
2022-06-22
Exploit prediction scoring system (EPSS) score for CVE-2009-3953
Probability of exploitation activity in the next 30 days: 97.26%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2009-3953
-
Adobe U3D CLODProgressiveMeshDeclaration Array Overrun
Disclosure Date: 2009-10-13First seen: 2020-04-26exploit/windows/fileformat/adobe_u3d_meshdeclThis module exploits an array overflow in Adobe Reader and Adobe Acrobat. Affected versions include < 7.1.4, < 8.2, and < 9.3. By creating a specially crafted pdf that a contains malformed U3D data, an attacker may be able to execute arbitrary code. Au
CVSS scores for CVE-2009-3953
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
CWE ids for CVE-2009-3953
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-3953
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/55551
- http://www.redhat.com/support/errata/RHSA-2010-0060.html
-
http://www.vupen.com/english/advisories/2010/0103
Vendor Advisory
-
http://www.adobe.com/support/security/bulletins/apsb10-02.html
Adobe - Security Bulletin APSB10-02 Security updates available for Adobe Reader and AcrobatPatch;Vendor Advisory
-
http://www.us-cert.gov/cas/techalerts/TA10-013A.html
US Government Resource
-
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
[security-announce] SUSE Security Announcement: acoread (SUSE-SA:2010:00
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242
-
http://www.securityfocus.com/bid/37758
- https://bugzilla.redhat.com/show_bug.cgi?id=554293
- http://www.securitytracker.com/id?1023446
-
http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl
Products affected by CVE-2009-3953
- cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:4.0.5a:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:4.0.5c:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:6.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:6.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:6.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:4.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:6.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:6.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:3.02:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:3.01:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:4.0.5a:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:4.0.5c:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:5.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:5.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:6.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:6.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:6.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:5.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:3.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:6.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:6.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:6.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.1.3:*:*:*:*:*:*:*