CVE-2009-2564
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other...
CVE-2009-2564 is a high vulnerability (CVSS 7.2) in Corel Getplus Download Manager, published July 21, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.60%, the 93rd percentile. No source names a fixed version.
- Severity
- 7.2 HighCVSS 2.0, NVD
- Exploit chance
- 5.60%EPSS, 93rd percentile
- Exploitation
- None known2 public exploits
- Fixed in
- No fix listedNo source names one
Description
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Adobe 9.x Related Service - 'getPlus_HelperSvc.exe' Local Privilege Escalation | 2009-07-20 |
| Exploit-DB | Adobe Acrobat 9.1.2 NOS - Local Privilege Escalation | 2009-07-21 |
What each source reports
NVD Score used
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.
- Record
CVE-2009-2564- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.
- Record
CVE-2009-2564- Updated
- 2026-11-02
EUVDEUVD-2009-2559No score
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.
- Record
EUVD-2009-2559- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9x38-fqhc-vfhfNo score
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other...
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.
- Record
GHSA-9x38-fqhc-vfhf- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
exploit-db.com/exploits/9199
us-cert.gov/cas/techalerts/TA09-286B.html
securitytracker.com/id?1023007
adobe.com/support/security/bulletins/apsb09-15.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5719
securityfocus.com/bid/35740
Show 10 moreShow less
vupen.com/english/advisories/2009/1969
retrogod.altervista.org/9sg_adobe_local.html
exchange.xforce.ibmcloud.com/vulnerabilities/54383
secunia.com/advisories/35930
blogs.adobe.com/psirt/2009/07/local_privilege_escalation_in.html
nvd.nist.gov/vuln/detail/CVE-2009-2564
github.com/advisories/GHSA-9x38-fqhc-vfhf