CVE-2009-3489

Adobe Photoshop Elements 8.0 installs the Adobe Active File Monitor V8 service with an insecure security descriptor, which allows local users to (1) stop the service via the stop command, (2) execute arbitrary commands as SYSTEM by using the config command to modify the binPath variable, or (3) restart the service via the start command.

• CWE-732

• http://blogs.adobe.com/psirt/2009/09/potential_photoshop_elements_8.htmlBroken Link
• http://retrogod.altervista.org/9sg_adobe_pe_local.htmlBroken Link, Exploit
• http://secunia.com/advisories/36895Broken Link
• http://www.securityfocus.com/archive/1/506806/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/36542Broken Link, Exploit, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1022963Broken Link, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2009/2798Permissions Required
• http://blogs.adobe.com/psirt/2009/09/potential_photoshop_elements_8.htmlBroken Link
• http://retrogod.altervista.org/9sg_adobe_pe_local.htmlBroken Link, Exploit
• http://secunia.com/advisories/36895Broken Link
• http://www.securityfocus.com/archive/1/506806/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/36542Broken Link, Exploit, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1022963Broken Link, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2009/2798Permissions Required

Published

Sep 30, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3483Heap-based buffer overflow in the Create New Site feature in…
• CVE-2009-3484Stack-based buffer overflow in Core FTP 2.1 build 1612 allow…
• CVE-2009-3485Cross-site scripting (XSS) vulnerability in the J-Web interf…
• CVE-2009-3486Multiple cross-site scripting (XSS) vulnerabilities in the J…
• CVE-2009-3487Multiple cross-site scripting (XSS) vulnerabilities in the J…
• CVE-2009-3488Cross-site scripting (XSS) vulnerability in the Bibliography…
• CVE-2009-3490GNU Wget before 1.12 does not properly handle a '\0' charact…
• CVE-2009-3491SQL injection vulnerability in the Kinfusion SportFusion (co…
• CVE-2009-3492Multiple PHP remote file inclusion vulnerabilities in Loggix…
• CVE-2009-3493Multiple cross-site scripting (XSS) vulnerabilities in Zenas…
• CVE-2009-3494Multiple SQL injection vulnerabilities in index.php in T-HTB…
• CVE-2009-3495SQL injection vulnerability in view_mag.php in Vastal I-Tech…