Jun 8 CVE-2009-4324 Korean Peninsula Situation from iirj@nccu.edu.tw

CVE-2009-4324 Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009. 

Nothing new or exciting here except that they used  a computer located at the National Chengchi University (Taiwan) and that many AV still fail at the detection of this particular CVE.

 
 Download ATT77316.pdf  100cf902ac31766f7d8a521eeb6f8d68 as a password protected archive (let me know if you need the password)



-----Original Message-----
From: iirj [mailto:iirj@nccu.edu.tw]
Sent: Tuesday, June 08, 2010 10:05 PM
To: XXXXX
Subject: 天安艦後的朝鮮半島新局勢

您好
附上天安艦後的朝鮮半島新局勢

請參照附件
政治大學國際關係研究中心
蔡增家

Machine translation

----- Original Message -----From: iirj [mailto: iirj@nccu.edu.tw]Sent: Tuesday, June 08, 2010 10:05 PMTo: XXXXXSubject: Tian ship the new situation after the Korean PeninsulaHelloAn enclosed vessel days after the new situation on the Korean PeninsulaPlease refer to AppendixUniversity of International Relations and PoliticalZheng-Jia Tsai

 File ATT77316.pdf received on 2010.06.28 02:04:43 (UTC)

http://www.virustotal.com/analisis/6b182f64a8b04b3f0c287e29ccb8bacf66cc59b8be5756cf7fb968455fc78d6f-1277690683
Result: 12/40 (30%)
Antivirus     Version     Last Update     Result
a-squared    5.0.0.30    2010.06.28    Exploit.JS.Mult!IK
Avast    4.8.1351.0    2010.06.27    JS:Pdfka-AEE
Avast5    5.0.332.0    2010.06.27    JS:Pdfka-AEE
BitDefender    7.2    2010.06.28    Exploit.PDF-JS.Gen
Comodo    5238    2010.06.27    UnclassifiedMalware
F-Prot    4.6.1.107    2010.06.27    JS/ShellCode.BF.gen
F-Secure    9.0.15370.0    2010.06.28    Exploit.PDF-JS.Gen
GData    21    2010.06.28    Exploit.PDF-JS.Gen
Ikarus    T3.1.1.84.0    2010.06.28    Exploit.JS.Mult
McAfee-GW-Edition    2010.1    2010.06.27    Heuristic.BehavesLike.PDF.Suspicious.O
Microsoft    1.5902    2010.06.27    Exploit:JS/Mult.CV
nProtect    2010-06-27.02    2010.06.27    Exploit.PDF-JS.Gen
Additional information
File size: 221345 bytes
MD5...: 100cf902ac31766f7d8a521eeb6f8d68

 Headers

Received: from faculty.nccu.edu.tw (HELO faculty.nccu.edu.tw) (140.119.166.66)
  by xxxxxxxxx
Received: By OpenMail Mailer;Wed, 09 Jun 2010 10:04:41 +0800 (CST)
From: "iirj"
Reply-To: iirj@nccu.edu.tw
Subject: =?big5?B?pNGmd8Slq+GqurTCwkGlYq5xt3OnvbbV?=
Message-ID: <1276049080.14398.iirj@nccu.edu.tw>
To: xxxxx
Date: Wed, 9 Jun 2010 10:04:40 +0800
MIME-Version: 1.0
Return-Path: iirj@nccu.edu.tw
Content-Type: multipart/mixed; boundary="---DBgb4Rh?+gBMpNxwZd2aL(DYw/="
 140.119.166.66

General IP Information
Hostname:    faculty.nccu.edu.tw
ISP:    MOEC
Organization:    National Chengchi University
Proxy:    None detected
Type:    Broadband
Assignment:    Static IP
Country:    Taiwan tw flag
State/Region:    T'ai-pei