Unscored severity · published Jul 21, 2009
CVE-2009-2564
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other…
–
CVSS
5.6%
EPSS
No
On KEV
Description
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.6% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Acrobat Reader · Adobe
9.0; 9.1 · source: NVD
GD
Getplus Download Manager · Nos Microsystems
1.6.2.36 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2564
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2564
blogs.adobe.com
http://blogs.adobe.com/psirt/2009/07/local_privilege_escalation_in.html
Exploit
http://retrogod.altervista.org/9sg_adobe_local.html
Vendor Advisory
http://secunia.com/advisories/35930
Vendor Advisory
http://secunia.com/advisories/36331
securitytracker.com
http://securitytracker.com/id?1023007
www.adobe.com
http://www.adobe.com/support/security/bulletins/apsb09-15.html
More from Acrobat Reader
9.8
CVE-2014-0546
Adobe Reader and Acrobat Sandbox Bypass Vulnerability
9.8
CVE-2013-3346
Adobe Reader and Acrobat Memory Corruption Vulnerability
9.8
CVE-2013-2729
Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability
9.8
CVE-2011-2462
Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability
8.8
CVE-2021-28550
Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution