Vulnerability Spotlight: Adobe Acrobat Reader DC Document ID Remote Code Execution Vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-4901 | An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. The vulnerability is caused by the computation that writes data past the end of the intended buffer; the computation is part of the document identity representation. An attacker can potentially leverage the vulnerability to corrupt sensitive data or execute arbitrary code. NVD description · AI analysis pending | 8.8 | 16% |
| — |
Full article319 words · extracted from blog.talosintelligence.com · click to collapse
Friday, February 23, 2018 10:22
Discovered by Aleksandar Nikolic of Cisco Talos
Overview
Today, Talos is releasing details of a new vulnerability within Adobe Acrobat Reader DC. Adobe Acrobat Reader is the most popular and most feature-rich PDF reader. It has a big user base, is usually a default PDF reader on systems and integrates into web browsers as a plugin for rendering PDFs. As such, tricking a user into visiting a malicious web page or sending a specially crafted email attachment can be enough to trigger this vulnerability.
A specific Javascript script embedded in a PDF file can cause the document ID field to be used in an unbounded copy operation leading to stack-based buffer overflow when opening a specially crafted PDF document in Adobe Acrobat Reader DC 2018.009.20044. This stack overflow can lead to return address overwrite which can result in arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file or access a malicious web page.
TALOS-2017-0505 - Adobe Acrobat Reader DC Document ID Remote Code Execution Vulnerability (CVE-2018-4901)
Adobe Acrobat Reader DC supports embedded Javascript scripts in the PDF to allow for interactive PDF forms. This give the potential attacker the ability to precisely control memory layout and poses additional attack surface.
When parsing a PDF file with overly large Document ID field specified in the trailer, it is parsed correctly initially, but when it's referenced in JavaScript, a stack-based buffer overflow can occur when encoding the bytes to a hex string. Detailed vulnerability information can be found here.
Known vulnerable versions
Adobe Acrobat Reader DC 2018.009.20044
Coverage
The following Snort Rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your FireSIGHT Management Center or Snort.org.
Snort Rules: 45102-3
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/vulnerability-spotlight-adobe-acrobat-63063210e63ef5e7e1ec313e/