‘Adobe Reader and Acrobat JavaScript Insecure Method Exposure Vulnerability’

Summary

Adobe Reader is ‘a program for viewing Portable Document Format (PDF) documents. Acrobat is the program used to create such documents’. Remote exploitation of an insecure method exposed by the JavaScript library in Adobe Reader and Acrobat could allow an attacker to execute arbitrary code as the current user.’

Credit:

‘The information has been provided by iDefense Labs.
The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=656


Details

Vulnerable Systems:
 * Adobe Reader version 8.1 on Windows XP SP2

Immune Systems:
 * Adobe Reader version 8.1.2

Adobe Reader and Acrobat implement a version of JavaScript in the EScript.api plug-in which is based on the reference implementation used in Mozilla products. One of the methods exposed allows direct control over low level features of the object, which in turn allows execution of arbitrary code.

Analysis:
Exploitation of this vulnerability would allow an attacker to execute arbitrary code as the current user. In order to exploit this vulnerability, an attacker would have to convince the targeted user to open a maliciously constructed file. This file could be sent directly to the targeted user or linked from a website.

Insufficient error checking is performed on the input which allows, among other things, attacker-supplied data to be written to arbitrary offsets in memory, potentially resulting in arbitrary code execution.

Workaround:
Disabling JavaScript in Adobe Reader or Acrobat will limit exposure to this vulnerability. When JavaScript is disabled, Adobe Reader will prompt the user that some components of the document may not function, and provide an opportunity to enable it.

Vendor response:
Adobe released version 8.1.2 of Adobe Reader and Acrobat to address this vulnerability. Although there is currently no update for version 7.0.9, Adobe reports it does plan to release one at a later date. For more information, visit the vendor’s advisory at the following URL: http://www.adobe.com/support/security/advisories/apsa08-01.html

CVE Information:
CVE-2007-5663

Disclosure timeline:
10/03/2007 – Initial vendor notification
10/03/2007 – Initial vendor response
10/26/2007 – Request for status
10/26/2007 – Status – Est. early January
01/04/2008 – Request for status
01/04/2008 – Status – Scheduled early February
01/28/2008 – Adobe plans patch for 8, but not 7
01/30/2008 – Concerns about the plan e-mailed to Adobe
01/31/2008 – Telephone call to clarify concerns
02/06/2008 – Adobe releases 8.1.2
02/07/2008 – Adobe publishes APSA08-01
02/08/2008 – Public disclosure’

Categories: Windows