製品・ソフトウェアに関する情報

JVN脆弱性詳細

Adobe Reader および Acrobat におけるスクリプトインジェクションの脆弱性に関連した脆弱性

Title	Adobe Reader および Acrobat におけるスクリプトインジェクションの脆弱性に関連した脆弱性
Summary	Microsoft Windows および Apple Mac OS X 上で稼動する Adobe Reader および Acrobat のデフォルト設定には、拡張セキュリティ機能を適切にサポートしないため、スクリプトインジェクションの脆弱性に関連した影響および攻撃の脆弱性が存在します。
Possible impacts	スクリプトインジェクションの脆弱性に関連した影響および攻撃の可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 12, 2010, midnight
Registration Date	Feb. 10, 2010, 1:39 p.m.
Last Update	Feb. 10, 2010, 1:39 p.m.

CVSS2.0 : 危険
Score	10
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected System

レッドハット

Red Hat Enterprise Linux Extras 3 extras

Red Hat Enterprise Linux Extras 4 extras

Red Hat Enterprise Linux Extras 4.8.z extras

RHEL Desktop Supplementary 5 (client)

RHEL Supplementary 5 (server)

RHEL Supplementary EUS 5.4.z (server)

アドビシステムズ

Adobe Acrobat 8.2 未満

Adobe Acrobat 9.3 未満

Adobe Reader 8.2 未満

Adobe Reader 9.3 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-3956	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3956
National Vulnerability Database (NVD)
2	CVE-2009-3956	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3956

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-16	https://jvndb.jvn.jp/ja/cwe/CWE-16.html

ベンダー情報

No	Name	URL
Adobe Security Bulletin
1	APSB10-02	http://www.adobe.com/support/security/bulletins/apsb10-02.html
Adobe セキュリティ情報
2	APSB10-02	http://www.adobe.com/jp/support/security/bulletins/apsb10-02.html
Red Hat Security Advisory
3	RHSA-2010:0037	https://rhn.redhat.com/errata/RHSA-2010-0037.html
4	RHSA-2010:0038	https://rhn.redhat.com/errata/RHSA-2010-0038.html
5	RHSA-2010:0060	https://rhn.redhat.com/errata/RHSA-2010-0060.html
富士通セキュリティ情報
6	TA10-013A	http://software.fujitsu.com/jp/security/vulnerabilities/ta10-013a.html

その他

No	Name	URL
IPA 緊急対策情報
1	20100113-adobe	http://www.ipa.go.jp/security/ciadr/vul/20100113-adobe.html
JPCERT 緊急報告
2	JPCERT-AT-2010-0003	http://www.jpcert.or.jp/at/2010/at100003.txt
JVN
3	JVNTA10-013A	http://jvn.jp/cert/JVNTA10-013A/
JVN Status Tracking Notes
4	JVNTR-2010-03	http://jvn.jp/tr/JVNTR-2010-03/
SecurityFocus
5	37763	http://www.securityfocus.com/bid/37763
SecurityTracker
6	1023446	http://www.securitytracker.com/id?1023446
US-CERT Cyber Security Alerts
7	SA10-013A	http://www.us-cert.gov/cas/alerts/SA10-013A.html
US-CERT Technical Cyber Security Alert
8	TA10-013A	http://www.us-cert.gov/cas/techalerts/TA10-013A.html
VUPEN Security
9	VUPEN/ADV-2010-0103	http://www.vupen.com/english/advisories/2010/0103
警察庁 @police
10	アドビシステムズ社の Adobe Reader および Adobe Acrobat のセキュリティ修正プログラムについて	http://www.npa.go.jp/cyberpolice/index.html#topics

Change Log

No	Changed Details	Date of change
0	[2010年02月10日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2009-3956

Summary	The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a "script injection vulnerability," as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.
Summary	Per: http://www.adobe.com/support/security/bulletins/apsb10-02.html Affected software versions Adobe Reader 9.2 and earlier versions for Windows, Macintosh, and UNIX Adobe Acrobat 9.2 and earlier versions for Windows and Macintosh
Summary	Per: http://www.adobe.com/support/security/bulletins/apsb10-02.html a script injection vulnerability by changing the Enhanced Security default (CVE-2009-3956).
Publication Date	Jan. 14, 2010, 4:30 a.m.
Registration Date	Jan. 29, 2021, 1:25 p.m.
Last Update	Oct. 31, 2018, 1:25 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:adobe:acrobat:3.0:::::::*
cpe:2.3:a:adobe:acrobat:3.1:::::::*
cpe:2.3:a:adobe:acrobat:4.0:::::::*
cpe:2.3:a:adobe:acrobat:4.0.5:::::::*
cpe:2.3:a:adobe:acrobat:4.0.5a:::::::*
cpe:2.3:a:adobe:acrobat:4.0.5c:::::::*
cpe:2.3:a:adobe:acrobat:5.0:::::::*
cpe:2.3:a:adobe:acrobat:5.0.5:::::::*
cpe:2.3:a:adobe:acrobat:5.0.6:::::::*
cpe:2.3:a:adobe:acrobat:5.0.10:::::::*
cpe:2.3:a:adobe:acrobat:6.0:::::::*
cpe:2.3:a:adobe:acrobat:6.0.1:::::::*
cpe:2.3:a:adobe:acrobat:6.0.2:::::::*
cpe:2.3:a:adobe:acrobat:6.0.3:::::::*
cpe:2.3:a:adobe:acrobat:6.0.4:::::::*
cpe:2.3:a:adobe:acrobat:6.0.5:::::::*
cpe:2.3:a:adobe:acrobat:6.0.6:::::::*
cpe:2.3:a:adobe:acrobat:7.0:::::::*
cpe:2.3:a:adobe:acrobat:7.0.1:::::::*
cpe:2.3:a:adobe:acrobat:7.0.2:::::::*
cpe:2.3:a:adobe:acrobat:7.0.3:::::::*
cpe:2.3:a:adobe:acrobat:7.0.4:::::::*
cpe:2.3:a:adobe:acrobat:7.0.5:::::::*
cpe:2.3:a:adobe:acrobat:7.0.6:::::::*
cpe:2.3:a:adobe:acrobat:7.0.7:::::::*
cpe:2.3:a:adobe:acrobat:7.0.8:::::::*
cpe:2.3:a:adobe:acrobat:7.0.9:::::::*
cpe:2.3:a:adobe:acrobat:7.1.0:::::::*
cpe:2.3:a:adobe:acrobat:7.1.1:::::::*
cpe:2.3:a:adobe:acrobat:7.1.2:::::::*
cpe:2.3:a:adobe:acrobat:7.1.3:::::::*
cpe:2.3:a:adobe:acrobat:7.1.4:::::::*
cpe:2.3:a:adobe:acrobat:8.0:::::::*
cpe:2.3:a:adobe:acrobat:8.1:::::::*
cpe:2.3:a:adobe:acrobat:8.1.1:::::::*
cpe:2.3:a:adobe:acrobat:8.1.2:::::::*
cpe:2.3:a:adobe:acrobat:8.1.3:::::::*
cpe:2.3:a:adobe:acrobat:8.1.4:::::::*
cpe:2.3:a:adobe:acrobat:8.1.5:::::::*
cpe:2.3:a:adobe:acrobat:8.1.6:::::::*
cpe:2.3:a:adobe:acrobat:8.1.7:::::::*
cpe:2.3:a:adobe:acrobat:9.0:::::::*
cpe:2.3:a:adobe:acrobat:9.1:::::::*
cpe:2.3:a:adobe:acrobat:9.1.1:::::::*
cpe:2.3:a:adobe:acrobat:9.1.2:::::::*
cpe:2.3:a:adobe:acrobat:9.1.3:::::::*
cpe:2.3:a:adobe:acrobat::::::::			9.2
execution environment
1	cpe:2.3:o:apple:mac_os_x::::::::
2	cpe:2.3:o:microsoft:windows::::::::

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:adobe:acrobat_reader:3.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:3.01:::::::*
cpe:2.3:a:adobe:acrobat_reader:3.02:::::::*
cpe:2.3:a:adobe:acrobat_reader:4.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:4.0.5:::::::*
cpe:2.3:a:adobe:acrobat_reader:4.0.5a:::::::*
cpe:2.3:a:adobe:acrobat_reader:4.0.5c:::::::*
cpe:2.3:a:adobe:acrobat_reader:4.5:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.0.5:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.0.6:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.0.7:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.0.9:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.0.10:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.0.11:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:6.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:6.0.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:6.0.2:::::::*
cpe:2.3:a:adobe:acrobat_reader:6.0.3:::::::*
cpe:2.3:a:adobe:acrobat_reader:6.0.4:::::::*
cpe:2.3:a:adobe:acrobat_reader:6.0.5:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.2:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.3:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.4:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.5:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.6:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.7:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.8:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.9:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.1.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.1.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.1.2:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.1.3:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.1.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.1.2:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.1.4:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.1.5:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.1.6:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.1.7:::::::*
cpe:2.3:a:adobe:acrobat_reader:9.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:9.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:9.1.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:9.1.2:::::::*
cpe:2.3:a:adobe:acrobat_reader:9.1.3:::::::*
cpe:2.3:a:adobe:acrobat_reader::::::::			9.2
execution environment
1	cpe:2.3:o:apple:mac_os_x::::::::
2	cpe:2.3:o:microsoft:windows::::::::
3	cpe:2.3:o:unix:unix::::::::

Related information, measures and tools

No	URL	refsource	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html	SUSE
2	http://secunia.com/advisories/38138	SECUNIA
3	http://secunia.com/advisories/38215	SECUNIA
4	http://www.adobe.com/support/security/bulletins/apsb10-02.html	CONFIRM	Patch Vendor Advisory
5	http://www.packetstormsecurity.org/1001-exploits/SS-2010-001.txt	MISC
6	http://www.redhat.com/support/errata/RHSA-2010-0060.html	REDHAT
7	http://www.securityfocus.com/bid/37763	BID
8	http://www.securitytracker.com/id?1023446	SECTRACK
9	http://www.stratsec.net/files/SS-2010-001_Stratsec_Acrobat_Script_Injection_Security_Advisory_v1.0.pdf	MISC
10	http://www.us-cert.gov/cas/techalerts/TA10-013A.html	CERT	US Government Resource
11	http://www.vupen.com/english/advisories/2010/0103	VUPEN
12	https://bugzilla.redhat.com/show_bug.cgi?id=554296	CONFIRM
13	https://exchange.xforce.ibmcloud.com/vulnerabilities/55554	XF
14	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8327	OVAL

Common Vulnerabilities List

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:adobe:acrobat:3.0:::::::*
cpe:2.3:a:adobe:acrobat:3.1:::::::*
cpe:2.3:a:adobe:acrobat:4.0:::::::*
cpe:2.3:a:adobe:acrobat:4.0.5:::::::*
cpe:2.3:a:adobe:acrobat:4.0.5a:::::::*
cpe:2.3:a:adobe:acrobat:4.0.5c:::::::*
cpe:2.3:a:adobe:acrobat:5.0:::::::*
cpe:2.3:a:adobe:acrobat:5.0.5:::::::*
cpe:2.3:a:adobe:acrobat:5.0.6:::::::*
cpe:2.3:a:adobe:acrobat:5.0.10:::::::*
cpe:2.3:a:adobe:acrobat:6.0:::::::*
cpe:2.3:a:adobe:acrobat:6.0.1:::::::*
cpe:2.3:a:adobe:acrobat:6.0.2:::::::*
cpe:2.3:a:adobe:acrobat:6.0.3:::::::*
cpe:2.3:a:adobe:acrobat:6.0.4:::::::*
cpe:2.3:a:adobe:acrobat:6.0.5:::::::*
cpe:2.3:a:adobe:acrobat:6.0.6:::::::*
cpe:2.3:a:adobe:acrobat:7.0:::::::*
cpe:2.3:a:adobe:acrobat:7.0.1:::::::*
cpe:2.3:a:adobe:acrobat:7.0.2:::::::*
cpe:2.3:a:adobe:acrobat:7.0.3:::::::*
cpe:2.3:a:adobe:acrobat:7.0.4:::::::*
cpe:2.3:a:adobe:acrobat:7.0.5:::::::*
cpe:2.3:a:adobe:acrobat:7.0.6:::::::*
cpe:2.3:a:adobe:acrobat:7.0.7:::::::*
cpe:2.3:a:adobe:acrobat:7.0.8:::::::*
cpe:2.3:a:adobe:acrobat:7.0.9:::::::*
cpe:2.3:a:adobe:acrobat:7.1.0:::::::*
cpe:2.3:a:adobe:acrobat:7.1.1:::::::*
cpe:2.3:a:adobe:acrobat:7.1.2:::::::*
cpe:2.3:a:adobe:acrobat:7.1.3:::::::*
cpe:2.3:a:adobe:acrobat:7.1.4:::::::*
cpe:2.3:a:adobe:acrobat:8.0:::::::*
cpe:2.3:a:adobe:acrobat:8.1:::::::*
cpe:2.3:a:adobe:acrobat:8.1.1:::::::*
cpe:2.3:a:adobe:acrobat:8.1.2:::::::*
cpe:2.3:a:adobe:acrobat:8.1.3:::::::*
cpe:2.3:a:adobe:acrobat:8.1.4:::::::*
cpe:2.3:a:adobe:acrobat:8.1.5:::::::*
cpe:2.3:a:adobe:acrobat:8.1.6:::::::*
cpe:2.3:a:adobe:acrobat:8.1.7:::::::*
cpe:2.3:a:adobe:acrobat:9.0:::::::*
cpe:2.3:a:adobe:acrobat:9.1:::::::*
cpe:2.3:a:adobe:acrobat:9.1.1:::::::*
cpe:2.3:a:adobe:acrobat:9.1.2:::::::*
cpe:2.3:a:adobe:acrobat:9.1.3:::::::*
cpe:2.3:a:adobe:acrobat::::::::			9.2
execution environment
1	cpe:2.3:o:apple:mac_os_x::::::::
2	cpe:2.3:o:microsoft:windows::::::::

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:adobe:acrobat_reader:3.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:3.01:::::::*
cpe:2.3:a:adobe:acrobat_reader:3.02:::::::*
cpe:2.3:a:adobe:acrobat_reader:4.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:4.0.5:::::::*
cpe:2.3:a:adobe:acrobat_reader:4.0.5a:::::::*
cpe:2.3:a:adobe:acrobat_reader:4.0.5c:::::::*
cpe:2.3:a:adobe:acrobat_reader:4.5:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.0.5:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.0.6:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.0.7:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.0.9:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.0.10:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.0.11:::::::*
cpe:2.3:a:adobe:acrobat_reader:5.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:6.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:6.0.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:6.0.2:::::::*
cpe:2.3:a:adobe:acrobat_reader:6.0.3:::::::*
cpe:2.3:a:adobe:acrobat_reader:6.0.4:::::::*
cpe:2.3:a:adobe:acrobat_reader:6.0.5:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.2:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.3:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.4:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.5:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.6:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.7:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.8:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.0.9:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.1.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.1.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.1.2:::::::*
cpe:2.3:a:adobe:acrobat_reader:7.1.3:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.1.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.1.2:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.1.4:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.1.5:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.1.6:::::::*
cpe:2.3:a:adobe:acrobat_reader:8.1.7:::::::*
cpe:2.3:a:adobe:acrobat_reader:9.0:::::::*
cpe:2.3:a:adobe:acrobat_reader:9.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:9.1.1:::::::*
cpe:2.3:a:adobe:acrobat_reader:9.1.2:::::::*
cpe:2.3:a:adobe:acrobat_reader:9.1.3:::::::*
cpe:2.3:a:adobe:acrobat_reader::::::::			9.2
execution environment
1	cpe:2.3:o:apple:mac_os_x::::::::
2	cpe:2.3:o:microsoft:windows::::::::
3	cpe:2.3:o:unix:unix::::::::