[UNIX] Adobe Acrobat Reader Buffer Overflow (UnixAppOpenFilePerform)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Adobe Acrobat Reader Buffer Overflow (UnixAppOpenFilePerform)
------------------------------------------------------------------------

SUMMARY

<http://www.adobe.com/products/acrobat/readermain.html> Adobe Acrobat
Reader is a program for viewing Portable Document Format (PDF) documents.

Remote exploitation of a buffer overflow in Adobe Acrobat Reader for UNIX
allows an attacker to execute arbitrary code.

DETAILS

Vulnerable Systems:
* Adobe Acrobat Reader version 5.0.9 for UNIX
* Adobe Acrobat Reader version 5.0.10 for UNIX

Immune Systems:
* Adobe Acrobat for Windows
* Adobe Acrobat version 7.0 for UNIX

The vulnerability specifically exists in the function
UnixAppOpenFilePerform(). This routine is called by Acrobat Reader while
opening a document containing a /Filespec tag. Within this routine,
sprintf is used to copy user-supplied data into a fixed-sized stack
buffer. This leads to a stack based overflow and the execution of
arbitrary code. The following demonstrates what the overflow looks like in
a debugger:
---------------------------------
#0 0x41414141 in ?? ()
(gdb) i r ebx
ebx 0xbfffef54 -1073746092
(gdb) x/x 0xbfffef54
0xbfffef54: 0x40404040
(gdb)
----------------------------------

As shown, EIP is easily controllable; ebx also points to the 4 bytes
before the EIP overwrite in a controlled buffer. This allows remote
exploitation without having to know stack addresses, as an attacker can
craft an exploit to return to a jmp ebx or call ebx instruction.

Successful exploitation allows an attacker to execute arbitrary code under
the privileges of the local user. Remote exploitation is possible via
e-mail attachment or link to the maliciously crafted PDF document. The
impact of this vulnerability is lessened by the fact that two error
messages appear before exploitation is successful; however, closing these
windows does not prevent exploitation from occurring.

Workaround:
User awareness is the best defense against this class of attack. Users
should be aware of the existence of such attacks and proceed with caution
when following links from suspicious or unsolicited e-mail. Users should
consider using an unaffected version of Adobe Acrobat, such as Acrobat
7.0.

Vendor response:
Adobe has addressed this issue in the following security advisory:
<http://www.adobe.com/support/techdocs/329083.html>
http://www.adobe.com/support/techdocs/329083.html

Adobe is recommending the following steps for remediation:
-- If you use Adobe Reader 5.0.9 or 5.0.10 on Linux or Solaris, download
Adobe Reader 7.0 at
<http://www.adobe.com/products/acrobat/readstep2.html>
www.adobe.com/products/acrobat/readstep2.html.

-- If you use Adobe Reader 5.0.9 or 5.0.10 on IBM-AIX or HP-UX,download
Adobe Reader 5.0.11 at
<http://www.adobe.com/products/acrobat/readstep2.html>
www.adobe.com/products/acrobat/readstep2.html.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1625>
CAN-2005-1625

Disclosure Timeline:
05.12.05 - Initial vendor notification
05.12.05 - Initial vendor response
07.05.05 - Public disclosure

ADDITIONAL INFORMATION

The information has been provided by <http://www.idefense.com/> iDEFENSE.
The original article can be found at:
<http://www.idefense.com/application/poi/display?id=279>
http://www.idefense.com/application/poi/display?id=279

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.