Dec 18 Adobe 0 day CVE-2009-4324 PDF attack of the Day (#5) merry christmas from uyghurhunova@yahoo.com Fri, 18 Dec 2009 11:11:27 -0800

• CVE-2009-4324 Use-after-free vulnerability in the Doc.media.newPlayer method in Adobe Reader and Acrobat 8.0 through 9.2, and possibly earlier versions, allows remote attackers to execute arbitrary code using ZLib compressed streams, as exploited in the wild in December 2009. 

 Download infected merry_christmas.pdf (password protected, please contact me or use the same password as you used on other CVE-2009-4324 samples)


Adobe is taking their sweet time to fix the problem while new variants show up. You don't need  ESP to predict that Christmas cards will be followed by New Year's invites and IRS forms before most people receive and install the updates. I was surprised that Symantec, being the CVE-2009-4324 pack leader in the past few days, did not detect it.  Tip of the hat to Messagelabs for catching it again.

From: Uyghur Hunova uyghurhunova@yahoo.com

Subject: merry christmas

Sent: Fri 12/18/2009 2:09 PM

My dear friend

Merry Christmas

 The message sender was
 uyghurhunova@yahoo.com
The message originating IP was 98.137.27.222 The message recipients were
    XXX@XXX.XXX
The message was titled merry christmas
The message date was Fri, 18 Dec 2009 11:11:27 -0800 (PST) The message identifier was <474701.46814.qm@web112506.mail.gq1.yahoo.com>
The virus or unauthorised code identified in the email is:
>>> Possible MalWare 'Exploit/Acroread-CVE-2009-4324' found in
>>> '8044614_1000X_PA3_APDF__pdf_obj_31_0.js'. Heuristics score: 401