Adobe Acrobat/Reader File Name Handler Buffer Overflow Vulnerability

Bugtraq ID:	10696
Class:	Boundary Condition Error
CVE:	CVE-2004-0632
Remote:	Yes
Local:	No
Published:	Jul 12 2004 12:00AM
Updated:	Jul 12 2009 06:16AM
Credit:	Discovery is credited to Greg MacManus of iDEFENSE Labs.
Vulnerable:	Adobe Reader 6.0.1 Adobe Reader 6.0 Adobe Acrobat 6.0.1 Adobe Acrobat 6.0
Not Vulnerable:	Adobe Reader 6.0.2 Adobe Acrobat 6.0.2

Adobe Acrobat/Reader File Name Handler Buffer Overflow Vulnerability

Adobe Acrobat and Reader are prone to a stack-based buffer overflow vulnerability.

This issue exists in routines that parse document filenames. A malformed file name may trigger this condition when the file is opened.

If a user could be enticed to open an appropriately named document, this could potentially allow for remote code execution.

This issue appears to affect Adobe Acrobat and Reader 6.x releases on Microsoft Windows platforms.

Adobe Acrobat/Reader File Name Handler Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Adobe Acrobat/Reader File Name Handler Buffer Overflow Vulnerability

Solution:
This issue has been addressed in Adobe Acrobat and Adobe Reader 6.0.2. Users are advised to upgrade.


Adobe Acrobat 6.0

• Adobe Acrobat 6.0.2
  http://www.adobe.com/support/downloads/main.html

Adobe Reader 6.0

• Adobe Reader 6.0.2
  http://www.adobe.com/support/downloads/main.html

Adobe Acrobat 6.0.1

• Adobe Acrobat 6.0.2
  http://www.adobe.com/support/downloads/main.html

Adobe Reader 6.0.1

• Adobe Reader 6.0.2
  http://www.adobe.com/support/downloads/main.html

Adobe Acrobat/Reader File Name Handler Buffer Overflow Vulnerability

References:

• Adobe Reader 6.0 Filename Handler Buffer Overflow Vulnerability (iDEFENSE)
  
• Issues addressed by the Acrobat 6.0.2 update and Adobe Reader 6.0.2 update (Adobe)