Bug 223113 - (CVE-2007-0044) CVE-2007-0044 Acrobat Reader Universal CSRF and session riding
CVE-2007-0044 Acrobat Reader Universal CSRF and session riding
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Kristian Høgsberg
: Security
Depends On: 432657 432658 432659
  Show dependency treegraph
Reported: 2007-01-17 17:13 EST by Josh Bressers
Modified: 2016-03-04 06:44 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-07-21 05:40:42 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Josh Bressers 2007-01-17 17:13:45 EST
Adobe Acrobat Reader versions 7.0.9 and below suffers from a flaw which can
allow a malicious web page to launch a session riding attack on a site via the
Acrobat Reader plugin.  Here is a quote from the original advisory:

1. Universal CSRF and session riding

This is probably Adobe related as all tested browsers (IE,Firefox,Opera) where
affected. The issue is that by creating a special link like this:


automatically Adobe plugin sends a request to 'victim.com' without user
interaction asking for defined page in 'fdf' parameter. This could be used as a
Universal Session Riding (aka UCSRF) attack which is a well known vulnerability. 
Note that the same effect is accomplished by using 'xml' and 'xfdf' parameters.

This flaw also affects acroread as shipped in RHEL3
Comment 1 Josh Bressers 2007-01-17 17:14:18 EST
This is also going to affect RHEL5, since it will ship with acroread 7.0.9
Comment 6 Red Hat Product Security 2008-07-21 05:40:42 EDT
This issue was addressed in:

Red Hat Enterprise Linux Extras:

Note You need to log in before you can comment on or make changes to this bug.