CVE:CVE-2003-0434
CNNVD:CNNVD-200307-028
Acrobat Reader/Xpdf是可以用于查看PDF文件的处理程序。
Acrobat Reader/Xpdf没有正确过滤超链接中的内容，远程攻击者可以利用这个漏洞诱使用户打开恶意PDF文件，导致包含的恶意命令以用户进程权限执行。
PDF文件允许包含超链接信息，由于PDF在处理超链接时没有过滤链接内容，并且PDF查看程序通过'sh -c'调用来处理请求，因此，攻击者构建特殊的恶意超链接，可导致嵌入的命令直接传递给SHELL执行，成功利用此漏洞，命令可能以用户进程权限执行。
solution:Upgrade adobe acrobat to a higher version than 5.0.6,and avoid the version 5.0.6; Upgrade xpdf xpdf to a higher version than 1.1,and avoid the version 1.1; Upgrade mandrakesoft mandrake_linux to a higher version than 9.0,9.1,and avoid the version 9.0,9.1; Upgrade mandrakesoft mandrake_linux_corporate_server to a higher version than 2.1,and avoid the version 2.1; Upgrade redhat enterprise_linux to a higher version than 2.1,and avoid the version 2.1; Upgrade redhat linux to a higher version than 7.1,7.2,7.3,8.0,9.0,and avoid the version 7.1,7.2,7.3,8.0,9.0; Upgrade redhat linux_advanced_workstation to a higher version than 2.1,and avoid the version 2.1