[NT] Adobe Acrobat/Reader 6 Local Files Access

From: SecuriTeam (support_at_securiteam.com)
Date: 10/13/04

  • Next message: SecuriTeam: "[UNIX] BMon Relative Path Privilege Escalation" 
    To: list@securiteam.com
Date: 13 Oct 2004 18:57:18 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Adobe Acrobat/Reader 6 Local Files Access
    ------------------------------------------------------------------------

    SUMMARY

    Acrobat/ Acrobat reader is software for viewing and printing Adobe
    Portable Document Format (PDF) files. Adobe PDF files can be viewed on
    most major operating systems.

    Version 6 of this program has an issue with the way it handles embedding
    macromedia flash files directly into a pdf. This allows a malicious
    website operator to steal local files from a user's hard drive including
    cookie files.

    DETAILS

    Vulnerable Systems:
     * Adobe Reader version 6.0.1
     * Adobe Acrobat version 6

    Version 6 of the pdf format introduced a new way to embed movies directly
    into the pdf file. In previous versions one could only link to media in
    external files

    Adobe reader extracts this swf file from the pdf and saves it under a
    random name to your temp dir, on windows XP and 2000 this dir is usually
    located at: C:\Documents and Settings\<username>\Local Settings\Temp

    It then appears to "link" directly to this saved file in effect making
    your local hard disk the codebase for this swf file and allowing it read
    access to all of the files on your hard drive

    Demonstration:
    Create a text file called c:\jelmer.txt then proceed to click on:
    http://62.131.86.111/security/acrobat/demo.pdf

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:jkuperus@planet.nl> Jelmer.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] BMon Relative Path Privilege Escalation"

    Relevant Pages

    • [EXPL] gv Local Buffer Overflow( Exploit Code Included )
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... overflow which can be exploited by an attacker sending a malformed ... postscript or Adobe pdf file. ... In order to perform exploitation, an attacker would have to trick a user ...
      (Securiteam)
    • Re: Word2007 does auto open PDF after Save as command
      ... Word MVP web site http://word.mvps.org ... but did notice that the Adobe set of values do not include ... information there to enable you to make the changes for PDF file ... I have already installed Adobe Reader 9.2, ...
      (microsoft.public.word.docmanagement)
    • RE: [Full-Disclosure] Re: Adobe acrobat / Adobe Reader 6 can read local files
      ... The demo uses script behind the scenes to start the movie, ... Subject: Re: Adobe acrobat / Adobe Reader 6 can read local ... > Document Format (PDF) files. ...
      (Full-Disclosure)
    • Re: Copying PDF images into Windows Paint
      ... I download both as PDF files, which I view in Adobe Reader 9. ... With IBD I can do this easily by clicking on the cartoon, which turns blue, then right-clicking on it which lets me copy it, and then using Ctrl+V to paste it into Paint in Windows XP. ... Anyone know how I can get this to work with the latter newspaper in PDF form as it does with the former? ... I realize this is more likely an Adobe problem than a Windows problem, but the relevant Adobe newsgroups seem to be abandoned, I haven't been able to find anything about it on the Adobe site, and I have no idea where else I could get the information. ...
      (microsoft.public.windowsxp.general)
    • Re: Adobe file to Word 6 Document
      ... And when you have the PDF open in Adobe Reader (the new official name of the ... Word MVP FAQ site: http://www.word.mvps.org ...
      (microsoft.public.word.newusers)