Adobe Acrobat Reader versions 7.0.9 and below suffers from a flaw which can allow a malicious web page to launch a session riding attack on a site via the Acrobat Reader plugin. Here is a quote from the original advisory: 1. Universal CSRF and session riding This is probably Adobe related as all tested browsers (IE,Firefox,Opera) where affected. The issue is that by creating a special link like this: http://site.com/file.pdf#FDF=http://victim.com/index.html?param= automatically Adobe plugin sends a request to 'victim.com' without user interaction asking for defined page in 'fdf' parameter. This could be used as a Universal Session Riding (aka UCSRF) attack which is a well known vulnerability. Note that the same effect is accomplished by using 'xml' and 'xfdf' parameters. This flaw also affects acroread as shipped in RHEL3
This is also going to affect RHEL5, since it will ship with acroread 7.0.9
This issue was addressed in: Red Hat Enterprise Linux Extras: http://rhn.redhat.com/errata/RHSA-2008-0144.html