Vulnerability Details : CVE-2014-9150
Race condition in the MoveFileEx call hook feature in Adobe Reader and Acrobat 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, and consequently write to files in arbitrary locations, via an NTFS junction attack, a similar issue to CVE-2014-0568.
Exploit prediction scoring system (EPSS) score for CVE-2014-9150
Probability of exploitation activity in the next 30 days: 0.64%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 77 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-9150
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:P |
10.0
|
4.9
|
NIST |
CWE ids for CVE-2014-9150
-
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-9150
-
http://helpx.adobe.com/security/products/reader/apsb14-28.html
Adobe Security BulletinPatch;Vendor Advisory
-
https://code.google.com/p/google-security-research/issues/detail?id=103
103 - Windows Acrobat Reader 11 Sandbox Escape in MoveFileEx IPC Hook - project-zero - Monorail
Products affected by CVE-2014-9150
- cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:11.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:11.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:11.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:11.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:11.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:11.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:11.0.5:-:*:*:*:windows:*:*
- cpe:2.3:a:adobe:acrobat_reader:11.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:11.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:11.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:11.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:11.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:11.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:11.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:11.0.5:-:*:*:*:windows:*:*
- cpe:2.3:a:adobe:acrobat:11.0.7:*:*:*:*:*:*:*