The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Adobe Reader and Acrobat Multiple Stack-based Buffer Overflow
Vulnerabilities
------------------------------------------------------------------------
SUMMARY
<http://www.adobe.com/products/acrobat/> Adobe Reader is "a program for
viewing Portable Document Format (PDF) documents. Acrobat is the program
used to create such documents". Remote exploitation of multiple
stack-based buffer overflows in JavaScript methods in Adobe Reader and
Acrobat could allow an attacker to execute arbitrary code as the current
user.
DETAILS
Vulnerable Systems:
* Adobe Reader version 8.1 on Windows XP SP2
Immune Systems:
* Adobe Reader version 8.1.2
These issues exist due to insufficient input validation in several
JavaScript methods. Inadequate checking is performed on the string length
before it is copied into a fixed sized buffer on the stack. If an attacker
supplies a long string, control structures on the stack may be modified,
allowing the execution of arbitrary code.
Analysis:
Exploitation of these vulnerabilities would allow an attacker to execute
arbitrary code as the current user. In order to exploit these
vulnerabilities, an attacker would have to convince a targeted user to
open a maliciously constructed file. This file could be sent directly to
the targeted user or linked from a website.
Workaround:
Disabling JavaScript in Adobe Reader or Acrobat will limit exposure to
these vulnerabilities. When JavaScript is disabled, Adobe Reader will
prompt the user that some components of the document may not function, and
provide an opportunity to enable it.
Vendor response:
Adobe released version 8.1.2 of Adobe Reader and Acrobat to address these
vulnerabilities. Although there is currently no update for version 7.0.9,
Adobe reports it does plan to release one at a later date. For more
information, visit the vendor's advisory at the following URL:
<http://www.adobe.com/support/security/advisories/apsa08-01.html>
http://www.adobe.com/support/security/advisories/apsa08-01.html
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5659>
CVE-2007-5659
Disclosure Timeline:
10/10/2007 - Initial vendor notification
10/10/2007 - Initial vendor response
10/26/2007 - Request for status
10/26/2007 - Status - Est. early January
01/04/2008 - Request for status
01/04/2008 - Status - Scheduled early February
01/28/2008 - Adobe plans patch for 8, but not 7
01/30/2008 - Concerns about the plan e-mailed to Adobe
01/31/2008 - Telephone call to clarify concerns
02/06/2008 - Adobe releases 8.1.2
02/06/2008 - Immunity makes PoC available to partners
02/07/2008 - Adobe publishes APSA08-01
02/08/2008 - Exploit discovered in the wild
02/08/2008 - Public disclosure
ADDITIONAL INFORMATION
The information has been provided by iDefense Labs.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=657>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=657
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
