Adobe Scrambling To Fix Another Serious PDF Flaw

It was only the start of July when we talked about Adobe Patching PDF Vulnerabilities Being Exploited In The Wild and once again they are suffering a serious vulnerability which allows code execution from a malicious PDF document.

This time the vulnerability came out during Black Hat and it seems to be serious as Adobe are rushing out a patch for the issue.

This issue effects Adobe Reader client for Windows, Mac and UNIX based systems. This follows shortly after Microsoft pushed out an emergency patch for the .LNK exploit.

Adobe is rushing to develop a patch for a vulnerability in Acrobat Reader revealed at the Black Hat security conference. The update–expected the week of August 16–will be the third time this year that Adobe has been forced to fix flaws outside of its regularly scheduled quarterly update pattern.

Adobe published a security bulletin announcing the upcoming update for Adobe Reader 9.3.3 for Windows, Mac OS X, and UNIX, and Adobe Acrobat for Windows and Mac, as well as Reader and Acrobat version 8.2.3 for the same platforms to resolve a number of security issues. Adobe noted “that these updates represent an out-of-band release. Adobe is currently scheduled to release the next quarterly security update for Adobe Reader and Acrobat on October 12, 2010.”

Microsoft also released an out-of-band patch for the Windows shortcut vulnerability–only a week ahead of the planned Patch Tuesday updates. The rapid turnaround by Adobe from vulnerability discovery to patch is commendable, but the rise in zero-day exploits forcing both Adobe and Microsoft to frequently provide updates outside of the normal patch release cycle threatens to negate the benefits of having a regularly scheduled patch release system.

The issue being addressed by Adobe is a vulnerability in Adobe Reader which was unveiled at Black Hat by security researcher Charlie Miller. Miller has made a name for himself by repeatedly winning the Pwn2Own contest at the CanSec West security conference.

Charlie Miller has rocked it out before at Pwn2Own (more than once) and it was him who unveiled this vulnerability at Black Hat in recent weeks. Adobe have been criticized in the past for not being pro-active enough in their security efforts and coming out with classics like “Wait until year end for security patches”. This is also mentioned in another Network World article published at the same time here.

At least they are jumping to attention this time and doing something about it. And don’t be fooled, this is a serious exploit that can lead to arbitrary code execution when a vulnerable user views a maliciously crafted PDF file containing this exploit.

A Secunia advisory related to the Adobe flaw explains “The vulnerability is caused due to an integer overflow error in CoolType.dll when parsing the “maxCompositePoints” field value in the “maxp” (Maximum Profile) table of a TrueType font. This can be exploited to corrupt memory via a PDF file containing a specially crafted TrueType font.”

Summed up in plain English that IT admins and users who are not developers can understand, Secunia adds “Successful exploitation may allow execution of arbitrary code.” Bottom line: an attacker could exploit the Adobe Reader flaw to take control of a vulnerable system and install or execute other malicious software.

Interestingly, it is a flaw in the way fonts are rendered in PDF documents that allows the JailbreakMe Web site to circumvent iPhone defenses and alter the core functionality of the smartphone OS. However, according to Miller the flaws are unrelated to one another. Thankfully, Apple is hard at work updating iOS to address that issue.

As mentioned in the last paragraph the web based jailbreak for Apples latest iOS is also using a PDF flaw as the base exploit to run the jailbreak.

It seems like PDF is breaking in all kinds of different ways, perhaps time to look for a format? Or at least use other PDF readers as we’ve suggested before with Foxit! Although it has a share of vulnerabilities too they are far fewer and less serious than those in Adobe software. Another option suggestion is Nuance PDF Reader.

Source: Network World