Security Intelligence Operations

Adobe Reader and Adobe Acrobat Professional, Professional Extended, Standard, and 3D contain a buffer overflow vulnerability that could allow a remote attacker to create a denial of service (DoS) condition or execute arbitrary code with the privileges of the user.

The vulnerability is due to an input validation error when these products handle malicious .pdf files. An unauthenticated, remote attacker could exploit the vulnerability by convincing a user to open a malicious PDF document using a vulnerable application. An exploit could allow the attacker to create a DoS condition or execute arbitrary code with the privileges of the user.

Exploit code is available and active in the wild.

Adobe has confirmed the vulnerability and released updated software

The following Adobe products are vulnerable:

• Reader versions 9 and prior
• Reader versions 8.1.3 and prior
• Reader versions 7.0.9 and prior
• Reader for Macintosh versions 9 and prior
• Reader for Macintosh versions 8.1.3 and prior
• Reader for Macintosh versions 7.0.9 and prior
• Reader for Unix versions 9 and prior
• Reader for Unix versions 8.1.3 and prior
• Acrobat for Macintosh versions 9 and prior
• Acrobat for Macintosh versions 8.1.3 and prior
• Acrobat for Macintosh versions 7.0.9 and prior
• Acrobat Standard versions 9 and prior
• Acrobat Professional versions 9 and prior
• Acrobat Professional Extended versions 9 and prior
• Acrobat 3D versions 8.1.3 and prior
• Acrobat 3D versions 7.0.9 and prior

To exploit the vulnerability, an attacker must convince a user to open a maliciously crafted PDF document. An attacker could employ social engineering by providing a malicious file in an e-mail message or another form of messaging that may make users more likely to visit an attacker-controlled website. Users may be more easily convinced to open a .pdf file because it is a common document type that is frequently used in normal business operations.

As a result of an exploit, the attacker could execute arbitrary code with the privileges of the user. On systems where the user is granted privileges equivalent to the Administrator account, the attacker could execute arbitrary code with elevated privileges. This could allow the attacker to take complete control over the system.

The actual vulnerability is in a non-JavaScript function; however, to achieve code execution, additional JavaScript code is needed. Disabling JavaScript code will not prevent a crash of the application, but it will prevent code execution from occurring.

The vulnerability is being actively exploited in the wild by the Trojan.Pidief.E trojan. Additional information about the trojan is available in IntelliShield Alert 14388. Reports indicate that networks of infected systems known as botnets are automatically distributing infected .pdf files. Although these attacks are reportedly limited in nature, this development may indicate that they could become more widespread.

Adobe has released a security advisory and security bulletins at the following links: APSA09-01, APSB09-03, and APSB09-04

Novell has released a security announcement at the following link: SUSE-SA:2009:014

Red Hat has released a security advisory at the following link: RHSA-2009:0376

Sun has re-released an alert notification at the following link: 256788

Turbolinux has released a security advisory at the following link: TLSA-2009-10

US-CERT has released a vulnerability note at the following link: VU#905281