New Adobe Acrobat [Reader] 0-Day On the Loose / CVE-2009-4324

[SysAdMini]

http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214

http://www.symantec.com/connect/blogs/zero-day-xmas-present

http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html

[SysAdMini]

http://www.f-secure.com/weblog/archives/00001836.html

http://extraexploit.blogspot.com/2009/12/adobe-cve-2009-4324-in-wild.html

[MysteryFCM]

Wonder if it's just a coinkydink that Piradius's network is involved?

[SysAdMini]

Adobe Reader media.newPlayer() Analysis (CVE-2009-4324)
http://vrt-sourcefire.blogspot.com/2009/12/adobe-reader-medianewplayer-analysis.html

[SysAdMini]

Adobe CVE-2009-4324 in the wild - (0day) - part 0.1 - browsing C&Cs
http://extraexploit.blogspot.com/2009/12/adobe-cve-2009-4324-in-wild-0day-part.html

[SysAdMini]

New Adobe Acrobat Zero-Day
http://www.symantec.com/connect/blogs/new-adobe-acrobat-zero-day

[SysAdMini]

Adobe CVE-2009-4324 in the wild - (0day) - part 0.4 - yourenter.com
http://extraexploit.blogspot.com/2009/12/adobe-cve-2009-4324-in-wild-0day-part_28.html

another sample :

http://www.malwaredomainlist.com/forums/index.php?topic=2640.msg13598#msg13598

[SysAdMini]

more samples, all are part of Eleonore exploit pack

Code: [Select]

t0rb.info/google/pdf.php
tonugood.cn/pdf.php

[cleanmx]

no hope adobe may release a urgent patch see:

http://www.h-online.com/security/news/item/Despite-increasingly-frequent-attacks-no-update-for-Adobe-s-Reader-891151.html


--gerhard

[SysAdMini]

sample

Code: [Select]

nnfoehfeff.com/sv777/pdf.php
still poor detection

http://www.virustotal.com/analisis/3d098273531877f6bac89d07c1a5041f052c4371fce28588d25bf7825bc33c76-1262112705 1/41
eTrust-Vet   35.1.7203   2009.12.29   PDF/Pidief!generic

[SysAdMini]

A quick look within the recent PDF zero day
http://blog.fortinet.com/a-quick-look-within-the-recent-pdf-zero-day/

[SysAdMini]

Another exploit for this vulnerability

http://wepawet.cs.ucsb.edu/view.php?hash=7d5a05af3bd04ebb22bf6f7ee50b3dee&t=1262129074&type=js

[SysAdMini]

Sophisticated, targeted malicious PDF documents exploiting CVE-2009-4324
http://isc.sans.org/diary.html?storyid=7867

[SysAdMini]

Selling Adobe exploit
http://seclists.org/fulldisclosure/2009/Dec/492