Adobe Acrobat/Acrobat Reader ActiveX Control URI Request Heap Buffer Overflow Vulnerability
BID:10947
Info
Adobe Acrobat/Acrobat Reader ActiveX Control URI Request Heap Buffer Overflow Vulnerability
| Bugtraq ID: | 10947 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2004-0629 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 16 2004 12:00AM |
| Updated: | Jul 12 2009 06:16AM |
| Credit: | Discovery of this vulnerability is credited to Rafel Ivgi. |
| Vulnerable: |
Adobe Reader 6.0.2 Adobe Reader 6.0.1 Adobe Reader 6.0 Adobe Reader 5.1 Adobe Reader 5.0.5 Adobe Reader 5.0 Adobe Acrobat 6.0.2 Adobe Acrobat 6.0.1 Adobe Acrobat 6.0 Adobe Acrobat 5.0.5 Adobe Acrobat 5.0 |
| Not Vulnerable: |
Adobe Reader 6.0.2 Adobe Acrobat 6.0.2 |
Discussion
Adobe Acrobat/Acrobat Reader ActiveX Control URI Request Heap Buffer Overflow Vulnerability
Adobe Acrobat/Acrobat Reader ActiveX control (pdf.ocx) is reported prone to a heap-based buffer overrun vulnerability, the issue presents itself due to a lack of sufficient boundary checking performed on URI data of GET requests.
It is reported that Microsoft IIS and Netscape Enterprise servers employ NULL bytes as URI terminators and so these HTTP servers may be used to launch an attack.
When a malicious URI is followed, the URI is copied into heap-based memory of the affected software without sufficient boundary checks. This results in heap-based memory management chunks being trampled by attacker-supplied URI data.
Ultimately this vulnerability may be exploited by a remote attacker to execute arbitrary code in the context of the user who is running the vulnerable software.
Adobe Acrobat/Acrobat Reader ActiveX control (pdf.ocx) is reported prone to a heap-based buffer overrun vulnerability, the issue presents itself due to a lack of sufficient boundary checking performed on URI data of GET requests.
It is reported that Microsoft IIS and Netscape Enterprise servers employ NULL bytes as URI terminators and so these HTTP servers may be used to launch an attack.
When a malicious URI is followed, the URI is copied into heap-based memory of the affected software without sufficient boundary checks. This results in heap-based memory management chunks being trampled by attacker-supplied URI data.
Ultimately this vulnerability may be exploited by a remote attacker to execute arbitrary code in the context of the user who is running the vulnerable software.
Exploit / POC
Adobe Acrobat/Acrobat Reader ActiveX Control URI Request Heap Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Adobe Acrobat/Acrobat Reader ActiveX Control URI Request Heap Buffer Overflow Vulnerability
Solution:
Adobe has released Adobe Reader 6.0.2 update to address this issue. This update is available for Windows and requires Adobe Reader 6.0.1 to be installed.
Adobe Reader 6.0.1
Solution:
Adobe has released Adobe Reader 6.0.2 update to address this issue. This update is available for Windows and requires Adobe Reader 6.0.1 to be installed.
Adobe Reader 6.0.1
-
Adobe Acro-Reader_6.0.2_Update.exe
http://www.adobe.com/support/downloads/thankyou.jsp?ftpID=2589&fileID= 2433
References
Adobe Acrobat/Acrobat Reader ActiveX Control URI Request Heap Buffer Overflow Vulnerability
References:
References: