Adobe Scrambling To Fix Another Serious PDF Flaw


It was only the start of July when we talked about Adobe Patching PDF Vulnerabilities Being Exploited In The Wild and once again they are suffering a serious vulnerability which allows code execution from a malicious PDF document.

This time the vulnerability came out during Black Hat and it seems to be serious as Adobe are rushing out a patch for the issue.

This issue effects Adobe Reader client for Windows, Mac and UNIX based systems. This follows shortly after Microsoft pushed out an emergency patch for the .LNK exploit.

Adobe is rushing to develop a patch for a vulnerability in Acrobat Reader revealed at the Black Hat security conference. The update–expected the week of August 16–will be the third time this year that Adobe has been forced to fix flaws outside of its regularly scheduled quarterly update pattern.

Adobe published a security bulletin announcing the upcoming update for Adobe Reader 9.3.3 for Windows, Mac OS X, and UNIX, and Adobe Acrobat for Windows and Mac, as well as Reader and Acrobat version 8.2.3 for the same platforms to resolve a number of security issues. Adobe noted “that these updates represent an out-of-band release. Adobe is currently scheduled to release the next quarterly security update for Adobe Reader and Acrobat on October 12, 2010.”

Microsoft also released an out-of-band patch for the Windows shortcut vulnerability–only a week ahead of the planned Patch Tuesday updates. The rapid turnaround by Adobe from vulnerability discovery to patch is commendable, but the rise in zero-day exploits forcing both Adobe and Microsoft to frequently provide updates outside of the normal patch release cycle threatens to negate the benefits of having a regularly scheduled patch release system.

The issue being addressed by Adobe is a vulnerability in Adobe Reader which was unveiled at Black Hat by security researcher Charlie Miller. Miller has made a name for himself by repeatedly winning the Pwn2Own contest at the CanSec West security conference.

Charlie Miller has rocked it out before at Pwn2Own (more than once) and it was him who unveiled this vulnerability at Black Hat in recent weeks. Adobe have been criticized in the past for not being pro-active enough in their security efforts and coming out with classics like “Wait until year end for security patches”. This is also mentioned in another Network World article published at the same time here.

At least they are jumping to attention this time and doing something about it. And don’t be fooled, this is a serious exploit that can lead to arbitrary code execution when a vulnerable user views a maliciously crafted PDF file containing this exploit.

A Secunia advisory related to the Adobe flaw explains “The vulnerability is caused due to an integer overflow error in CoolType.dll when parsing the “maxCompositePoints” field value in the “maxp” (Maximum Profile) table of a TrueType font. This can be exploited to corrupt memory via a PDF file containing a specially crafted TrueType font.”

Summed up in plain English that IT admins and users who are not developers can understand, Secunia adds “Successful exploitation may allow execution of arbitrary code.” Bottom line: an attacker could exploit the Adobe Reader flaw to take control of a vulnerable system and install or execute other malicious software.

Interestingly, it is a flaw in the way fonts are rendered in PDF documents that allows the JailbreakMe Web site to circumvent iPhone defenses and alter the core functionality of the smartphone OS. However, according to Miller the flaws are unrelated to one another. Thankfully, Apple is hard at work updating iOS to address that issue.

As mentioned in the last paragraph the web based jailbreak for Apples latest iOS is also using a PDF flaw as the base exploit to run the jailbreak.

It seems like PDF is breaking in all kinds of different ways, perhaps time to look for a format? Or at least use other PDF readers as we’ve suggested before with Foxit! Although it has a share of vulnerabilities too they are far fewer and less serious than those in Adobe software. Another option suggestion is Nuance PDF Reader.

Source: Network World

Posted in: Exploits/Vulnerabilities, Hacking News

, , , , , , ,


Latest Posts:


Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.
UBoat - Proof Of Concept PoC HTTP Botnet Project UBoat – Proof Of Concept PoC HTTP Botnet Project
UBoat is a PoC HTTP Botnet designed to replicate a full weaponised commercial botnet like the famous large scale infectors Festi, Grum, Zeus and SpyEye.
LambdaGuard - AWS Lambda Serverless Security Scanner LambdaGuard – AWS Lambda Serverless Security Scanner
LambdaGuard is a tool which allows you to visualise and audit the security of your serverless assets, an open-source AWS Lambda Serverless Security Scanner.
exe2powershell - Convert EXE to BAT Files exe2powershell – Convert EXE to BAT Files
exe2powershell is used to convert EXE to BAT files, the previously well known tool for this was exe2bat, this is a version for modern Windows.
HiddenWall - Create Hidden Kernel Modules HiddenWall – Create Hidden Kernel Modules
HiddenWall is a Linux kernel module generator used to create hidden kernel modules to protect your server from attackers.
Anteater - CI/CD Security Gate Check Framework Anteater – CI/CD Security Gate Check Framework
Anteater is a CI/CD Security Gate Check Framework to prevent the unwanted merging of filenames, binaries, deprecated functions, staging variables and more.


One Response to Adobe Scrambling To Fix Another Serious PDF Flaw

  1. Wojtek August 10, 2010 at 12:49 pm #

    Another PDF reader worth the look is X-Change PDF reader available at http://www.tracker-software.com/product/pdf-xchange-viewer.
    The free version is more than enough for typical users (display, annotate, print).

    On the occasion: thanks for your great site!