El zero day del Acrobat ya controlado por el VirusScan de McAfee con los DAT de hoy 5834

"McAfee"

Exploit-PDF.ag



Type Trojan



SubType Exploit



Discovery Date 12/15/2009



Length Varies



Minimum DAT 5834 (12/16/2009)



Updated DAT 5834 (12/16/2009)



Minimum Engine 5.3.00



Description Added 12/15/2009



Description Modified 12/15/2009 10:07 PM (PT)





Overview -



This detection covers maliciously crafted PDF files which attempts to exploit a vulnerability in Adobe Reader.







Characteristics -



-- Update December 16, 2009 --

The risk assessment of this threat has been updated to Low-Profiled due to media attention at: http://www.theregister.co.uk/2009/12/15/adobe_zero_day/



--



These maliciously crafted PDF files exploits a vulnerability in Adobe Reader (CVE-2009-4324).



More information from the vendor at:



•http://www.adobe.com/support/security/advisories/apsa09-07.html

When successful, recent variant drops and execute a malicious downloader currently detected as Generic Downloader.fg.



This downloads more malware from the following domain:



•foruminspace.com

Currently downloaded malware is detected as Generic Dropper.og.







Symptoms -



•Unexpected network connections from the Adobe Reader.

• In some cases, Adobe Reader crashes or terminates abnormally.





Method of Infection -

These maliciously crafted PDF files exploits a vulnerability in Adobe Reader 9.2 or older.



Removal -

AVERT recommends to always use latest DATs and engine. This threat will be cleaned if you have this combination.