Jul 01 CVE-2009-4324 results of press conference from chwenwen@ntu.edu.tw

CVE-2009-4324 Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

Download 949265ee1d3e587152a23311a85b3be9 ATT49937.pdf  as a password protected archive (contact me if you need the password)

-----Original Message-----
From: chwenwen@ntu.edu.tw [mailto:chwenwen@ntu.edu.tw]
Sent: Thursday, July 01, 2010 10:15 AM
To: XXXXXXXXXXXXXXX
Cc: XXXXXXXXXXXXXXXXXXXX
Subject: 第五次江陳會談成果記者會本會賴主委講話稿

各位專家學者，您好：
  謹寄送第五次江陳會談成果記者會本會賴主委講話稿，請參考，謝謝。
陸委會聯絡處敬上
                                              99.07.01

From: chwenwen@ntu.edu.tw [mailto: chwenwen@ntu.edu.tw]
Sent: Thursday, July 01, 2010 10:15 AM
To: XXXXXXXXXXXXXXXXXXXX
Cc: XXXXXXXXXXXXXX
Subject: results of the fifth meeting press conference Jiang Chen Lai-chairman of the Council speeches

The experts and scholars, Hello:
  Would like to send the results of the fifth meeting press conference Jiang Chen Lai-chairman of the Council speeches, see, thank you.
Sincerely, MAC Liaison
                                              99.07.01

  File ATT49937.pdf received on 2010.07.04 04:20:55 (UTC)
http://www.virustotal.com/analisis/cd4deed862ab102e7fbccc85ee87b09fbb3e6374b51b99f97c904abd4b590f01-1278217255
Result: 9/41 (21.96%)
a-squared    5.0.0.31    2010.07.03    Trojan.SWF.HeapSpray!IK
Avast    4.8.1351.0    2010.07.03    JS:Pdfka-gen
Avast5    5.0.332.0    2010.07.03    JS:Pdfka-gen
BitDefender    7.2    2010.07.04    Trojan.SWF.HeapSpray.C
F-Prot    4.6.1.107    2010.07.03    JS/Pdfka.V
F-Secure    9.0.15370.0    2010.07.03    Trojan.SWF.HeapSpray.C
GData    21    2010.07.04    Trojan.SWF.HeapSpray.C
Ikarus    T3.1.1.84.0    2010.07.03    Trojan.SWF.HeapSpray
McAfee-GW-Edition    2010.1    2010.07.02    Heuristic.BehavesLike.PDF.Suspicious.O
File size: 270909 bytes
MD5...: 949265ee1d3e587152a23311a85b3be9

 Vicheck.ca results
PDF Exploit call to media.newPlayer CVE-2009-4324
https://www.vicheck.ca/md5query.php?hash=949265ee1d3e587152a23311a85b3be9


Headers

Received: from wmail1.cc.ntu.edu.tw (HELO wmail1.cc.ntu.edu.tw) (140.112.2.161)
  by XXXXXXXXXXXXXXXXXXXXXX
Received: from localhost (localhost [127.0.0.1])
    by wmail1.cc.ntu.edu.tw (Postfix) with ESMTP id 5D3F135E83D;
    Thu,  1 Jul 2010 22:15:01 +0800 (CST)
Received: from 218.94.121.180 ([218.94.121.180]) by wmail1.cc.ntu.edu.tw
 (Horde Framework) with HTTP; Thu, 01 Jul 2010 22:15:01 +0800
Message-ID: <20100701221501.13862298y1rjpnmt@wmail1.cc.ntu.edu.tw>
Date: Thu, 1 Jul 2010 22:15:01 +0800
Disposition-Notification-To: chwenwen@ntu.edu.tw
From: chwenwen@ntu.edu.tw
To: XXXXXXXXXXXXX
CC: =XXXXXXXXXXXXXXX
Subject: =?big5?b?ssSkraa4pr+zr7d8vc2mqKpHsE+qzLd8pbu3fL/gpUSpZcG/uNy9Wg==?=
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="=_1ziwulawet45"
Content-Transfer-Encoding: 7bit
User-Agent: Internet Messaging Program (IMP) H3 (4.3.5) 
218.94.121.180
Hostname:    218.94.121.180
ISP:    Data Communication Division
Organization:    CHINANET jiangsu province network
Proxy:    None detected
Type:    Broadband
Assignment:    Static IP
Country:    China
State/Region:    Beijing
City:    Beijing