CVE-2014-9150 : Race condition in the MoveFileEx call hook feature in Adobe Reader and Acrobat 1

Race condition in the MoveFileEx call hook feature in Adobe Reader and Acrobat 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, and consequently write to files in arbitrary locations, via an NTFS junction attack, a similar issue to CVE-2014-0568.

Published 2014-11-30 02:59:00

Updated 2025-04-12 10:46:41

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2014-9150

Adobe » Acrobat Reader
Versions up to, including, (<=) 11.0.8
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat Reader » Version: 11.0
cpe:2.3:a:adobe:acrobat_reader:11.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat Reader » Version: 11.0.1
cpe:2.3:a:adobe:acrobat_reader:11.0.1:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat Reader » Version: 11.0.2
cpe:2.3:a:adobe:acrobat_reader:11.0.2:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat Reader » Version: 11.0.3
cpe:2.3:a:adobe:acrobat_reader:11.0.3:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat Reader » Version: 11.0.4
cpe:2.3:a:adobe:acrobat_reader:11.0.4:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat Reader » Version: 11.0.6
cpe:2.3:a:adobe:acrobat_reader:11.0.6:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat Reader » Version: 11.0.5 For Windows
cpe:2.3:a:adobe:acrobat_reader:11.0.5:-:*:*:*:windows:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat Reader » Version: 11.0.7
cpe:2.3:a:adobe:acrobat_reader:11.0.7:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat
Versions up to, including, (<=) 11.0.8
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat » Version: 11.0
cpe:2.3:a:adobe:acrobat:11.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat » Version: 11.0.1
cpe:2.3:a:adobe:acrobat:11.0.1:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat » Version: 11.0.2
cpe:2.3:a:adobe:acrobat:11.0.2:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat » Version: 11.0.3
cpe:2.3:a:adobe:acrobat:11.0.3:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat » Version: 11.0.4
cpe:2.3:a:adobe:acrobat:11.0.4:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat » Version: 11.0.6
cpe:2.3:a:adobe:acrobat:11.0.6:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat » Version: 11.0.5 For Windows
cpe:2.3:a:adobe:acrobat:11.0.5:-:*:*:*:windows:*:*
Matching versions
When used together with: Microsoft » Windows
Adobe » Acrobat » Version: 11.0.7
cpe:2.3:a:adobe:acrobat:11.0.7:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows

Exploit prediction scoring system (EPSS) score for CVE-2014-9150

EPSS FAQ

1.81%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 81 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-9150

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.4	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:P	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2014-9150

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-9150

http://helpx.adobe.com/security/products/reader/apsb14-28.html

Adobe Security Bulletin
Patch;Vendor Advisory

CVEs referencing this url
https://code.google.com/p/google-security-research/issues/detail?id=103

103 - Windows Acrobat Reader 11 Sandbox Escape in MoveFileEx IPC Hook - project-zero - Monorail

Jump to

Vulnerability Details : CVE-2014-9150

Products affected by CVE-2014-9150

Exploit prediction scoring system (EPSS) score for CVE-2014-9150

CVSS scores for CVE-2014-9150

CWE ids for CVE-2014-9150

References for CVE-2014-9150