Adobe Acrobat/Adobe Reader Safari Frameworks Folder Permission Escalation Vulnerability

Bugtraq ID:	14075
Class:	Design Error
CVE:	CVE-2005-1624
Remote:	No
Local:	Yes
Published:	Jun 27 2005 12:00AM
Updated:	Jul 12 2009 04:06PM
Credit:	Discovery is credited to John C. Welch.
Vulnerable:	Adobe Reader 7.0.1 Adobe Reader 7.0 Adobe Acrobat 7.0.1 Adobe Acrobat 7.0
Not Vulnerable:	Adobe Reader 7.0.2 Adobe Acrobat 7.0.2

Adobe Acrobat/Adobe Reader Safari Frameworks Folder Permission Escalation Vulnerability

Adobe Acrobat and Adobe Reader running on Mac OS X are affected by a folder permission escalation vulnerability.

The vulnerability exists in the Adobe Reader and Acrobat updater.

A successful attack can allow local attackers to add potentially malicious Frameworks leading to various attacks including potential privilege escalation.

Adobe Acrobat/Adobe Reader Safari Frameworks Folder Permission Escalation Vulnerability

An exploit is not required to leverage this issue.

Adobe Acrobat/Adobe Reader Safari Frameworks Folder Permission Escalation Vulnerability

Solution:
Adobe has released an advisory including updates to address this issue.


Adobe Acrobat 7.0

• Adobe Adobe Acrobat 7.0.2
  http://www.adobe.com/support/downloads/

Adobe Reader 7.0

• Adobe Adobe Acrobat Reader 7.0.2
  http://www.adobe.com/support/downloads/

Adobe Reader 7.0.1

• Adobe Adobe Acrobat Reader 7.0.2
  http://www.adobe.com/support/downloads/

Adobe Acrobat 7.0.1

• Adobe Adobe Acrobat 7.0.2
  http://www.adobe.com/support/downloads/

Adobe Acrobat/Adobe Reader Safari Frameworks Folder Permission Escalation Vulnerability

References:

• Adobe Homepage (Adobe)
  
• Updater elevates folder permissions (Acrobat and Adobe Reader on Mac OS) (Adobe)