The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Adobe Acrobat Reader (UNIX) Uudecode Filename Buffer Overflow
Vulnerability
------------------------------------------------------------------------
SUMMARY
" <http://www.adobe.com/products/acrobat/readermain.html> Adobe Reader is
free software that lets you view and print Adobe Portable Document Format
(PDF) files on a variety of devices and operating systems."
The UNIX version of Adobe Reader (previously Acrobat Reader) is vulnerable
to a buffer overflow in its uudecoding routines that enables an attacker
to facilitate code execution on the target machine.
DETAILS
Vulnerable Systems:
* Adobe Reader versions up to 5.0.6 for UNIX, inclusive
Immune Systems:
* Adobe Reader version 5.0.9 for UNIX
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0631>
CAN-2004-0631
Uuencoding is a scheme that converts 8 bit data into a 6-bit format,
suitable for transmission via Email. The UNIX and Linux versions of Adobe
Acrobat Reader automatically attempt to convert uuencoded documents back
into their original format.
The vulnerability specifically exists in that Acrobat Reader fails to
check the length of the filename before copying it into a fixed length
buffer. This allows a maliciously constructed file to cause a buffer
overflow resulting in the execution of arbitrary code.
Successful exploitation allows attackers to execute arbitrary code under
the privileges of the user who opened the malicious document with a
vulnerable version of Adobe Acrobat Reader. PDF documents are frequently
exchanged via Email and in combination with a social engineering attack
allows attackers to remotely exploit this vulnerability.
Vendor Status:
Adobe has been informed of the buffer overflow condition according to the
publicized timeline. However, the vendor appears to have silently fixed
this vulnerability without coordinating public disclosure of the issue.
Moreover, the vendor does not appear to have publicly posted details of
the security fix to inform clients of the risks posed by un-patched
versions of the software.
Since it is hard to tell at which time Adobe released a fixed version,
users are encouraged to upgrade to the latest 5.0.9 version that was
tested and found immune by iDEFENSE.
Disclosure Timeline
* 03/30/2004 Initial vendor notification
* 04/01/2004 iDEFENSE clients notified
* 04/06/2004 Initial vendor response
* 05/19/2004 Date stamp on patched binary
* 08/12/2004 Public disclosure
ADDITIONAL INFORMATION
The information has been provided by
<mailto:idlabs-advisories@idefense.com> iDEFENSE Security Labs.
The original article can be found at:
<http://idefense.com/application/poi/display?id=125&type=vulnerabilities>
http://idefense.com/application/poi/display?id=125&type=vulnerabilities
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
