Adobe Reader/Acrobat U3D Memory Corruption RCE

Successful exploitation can allow remote arbitrary code execution in the context of the user running Adobe Reader or Acrobat. Where code execution is not achieved, the vulnerability can still cause a denial of service via application crash due to memory corruption. In observed in-the-wild exploitation, the flaw was used to deliver malware and establish post-exploitation footholds on victim systems.

Until patching is completed, reduce exposure by disabling or restricting PDF handling from untrusted sources, especially email attachments and web-delivered PDFs; using Protected Mode/sandboxing and least-privilege user contexts where available; blocking or detoning suspicious PDFs at mail and web gateways; and limiting Adobe Reader/Acrobat execution on high-risk systems. Network and endpoint monitoring for exploitation artifacts and follow-on payloads associated with this CVE, including suspicious Reader/Acrobat child-process or injection behavior, can further reduce risk.

Upgrade Adobe Reader and Adobe Acrobat to a version that includes Adobe's fix for CVE-2011-2462. Specifically, organizations should move off Adobe Reader/Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, to vendor-supported patched releases. Standard remediation should also include retiring unsupported product branches and validating that PDF-handling endpoints receive current security updates.