Alert GCSA-10039 - Vulnerabilita' in Adobe Reader e Acrobat

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


******************************************************************

    Alert ID : GCSA-10039
        Data : 14 aprile 2010
      Titolo : Vulnerabilita' in  Adobe Reader e Acrobat (APSB10-09)

******************************************************************

:: Descrizione del problema

   Adobe ha rilasciato il bollettino di sicurezza APSB10-09 per
   risolvere varie vulnerabilita' che affliggono i prodotti Adobe
   Reader e Acrobat.

   Un attaccante puo' sfruttare queste vulnerabilita' convincendo
   l'utente ad aprire file pdf appositamente predisposti. La maggior
   parte dei browser web attualmente disponibili sono minuti di un
   apposito Adobe Reader plug-in che consente la visualizzazione
   automatica di file pdf ospitati in un web server.


:: Software interessato

     Adobe Reader 9.3.1 e versioni 9.x precedenti
     Adobe Reader 8.2.1 e versioni precedenti
     Adobe Acrobat 9.3.1 e versioni 9.x precedenti
     Adobe Acrobat 8.2.1 e versioni precedenti


:: Impatto

     Esecuzione remota di codice arbitrario
     Scrittura di file e cartelle arbitrari sul file system
     Denial of service
     Accesso ad informazioni sensibili


:: Soluzioni

   Consultare il contenuto di Adobe Security Bulletin APSB10-09

     http://www.adobe.com/support/security/bulletins/apsb10-09.html

   per i riferimenti sull'aggiornamento di Adobe Reader e Acrobat nei
   vari sistemi operativi.


   Altre soluzioni temporanee sono:
     - non aprire file pdf provenienti da fonti non fidate
     - disabilitare la visualizzazione automatica di pdf nel browser
     - disabilitare javascript in Adobe Reader e Acrobat


:: Riferimenti

Security update available for Adobe Reader and Acrobat
   <http://www.adobe.com/support/security/bulletins/apsb10-09.html

Technical Cyber Security Alert TA10-103C
    http://www.us-cert.gov/cas/techalerts/TA10-103C.html

ZDI
   http://www.zerodayinitiative.com/advisories/ZDI-10-071/

VUPEN
   http://www.vupen.com/english/advisories/2010/0873

Secunia
   http://secunia.com/advisories/39272/

Securityfocus
   http://www.securityfocus.com/bid/39329
   http://www.securityfocus.com/bid/39417
   http://www.securityfocus.com/bid/39469
   http://www.securityfocus.com/bid/39470

Mitre's CVE ID
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0190
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0191
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0192
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0193
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0194
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0195
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0196
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0197
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0198
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0199
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0201
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0202
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0203
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0204
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1241


-----BEGIN PGP SIGNATURE-----

iQCVAwUBS8XcK/OB+SpikaiRAQK06gP/Q4vyAnOMqqs9/Ogk4CjLJm7U4f1WTBMF
2QXr/1MFzzmftuxSrdv9nOXZzWXl1+8+t7qDsxlr2JCelCwf04bFu6FtTZCTPCOn
mHDNgQDVT7K3ofEfP2qNixkcfTfIt44PKL73t3re2qYBuey5GcICT2lk0fZcqezy
eX2Mxvl4If8=
=ut6o
-----END PGP SIGNATURE-----