Adobe Reader 'util.printf()' JavaScript Function Stack Buffer Overflow Vulnerability

Bugtraq ID:	30035
Class:	Boundary Condition Error
CVE:	CVE-2008-2992
Remote:	Yes
Local:	No
Published:	Nov 04 2008 12:00AM
Updated:	May 12 2015 07:48PM
Credit:	Dyon Balding of Secunia Research and Damian Frizza from the CORE IMPACT Exploit Writers Team at Core Security Technologies
Vulnerable:	Turbolinux Client 2008 Sun Solaris 10_sparc Nortel Networks Self-Service Speech Server 0 Nortel Networks Self-Service Peri Workstation 0 Nortel Networks Self-Service Peri Application 0 Nortel Networks Self-Service MPS 500 0 Nortel Networks Self-Service MPS 1000 0 Nortel Networks Self-Service - CCSS7 0 Nortel Networks CallPilot 703t Nortel Networks CallPilot 600r Nortel Networks CallPilot 201i Nortel Networks CallPilot 1005r Nortel Networks CallPilot 1002rp Gentoo Linux Avaya IR 3.0 Avaya Interactive Response 3.0 Avaya Interactive Response 2.0 Adobe Reader 8.1.2 Adobe Reader 8.1.1 Adobe Reader 8.1.2 Security Updat Adobe Reader 8.1 Adobe Reader 8.0 Adobe Acrobat Standard 8.1.2 Adobe Acrobat Standard 8.1.1 Adobe Acrobat Standard 8.1 Adobe Acrobat Standard 8.0 Adobe Acrobat Professional 8.1.2 Adobe Acrobat Professional 8.1.1 Adobe Acrobat Professional 8.1.2 Security Updat Adobe Acrobat Professional 8.1 Adobe Acrobat Professional 8.0 Adobe Acrobat 3D 8.1.2 Adobe Acrobat 3D 0
Not Vulnerable:	Adobe Reader 8.1.3 Adobe Reader 9.0 Adobe Acrobat Standard 8.1.3 Adobe Acrobat Professional 8.1.3 Adobe Acrobat 3D 8.1.3

Adobe Reader 'util.printf()' JavaScript Function Stack Buffer Overflow Vulnerability

Adobe Reader is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the application or crash the application, denying service to legitimate users.

Adobe Reader 'util.printf()' JavaScript Function Stack Buffer Overflow Vulnerability

UPDATE (November 7, 2008): In-the-wild exploit attempts have been detected.

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploit is available through Immunity Early Updates:

https://www.immunityinc.com/downloads/immpartners/acrobat_js3.tgz

The following exploit is available. Note that Symantec has not tested or verified this exploit. Always use caution when handling exploits.

• /data/vulnerabilities/exploits/30035.zip
• /data/vulnerabilities/exploits/30035.c

Adobe Reader 'util.printf()' JavaScript Function Stack Buffer Overflow Vulnerability

Solution:
A vendor update is available. Please see the references for more information.

Adobe Reader 'util.printf()' JavaScript Function Stack Buffer Overflow Vulnerability

References:

• Adobe Homepage (Adobe)
  
• CORE-2008-0526: Adobe Reader Javascript Printf Buffer Overflow (CORE Security Technologies Advisories )
  
• Secunia Research: Adobe Acrobat/Reader 'util.printf()' Buffer Overflow (Secunia Research )
  
• ZDI-08-072: Adobe Acrobat PDF Javascript printf Stack Overflow Vulnerability ([email protected])
  
• Nortel Response to Adobe Vulnerability Identifier APSB08-19 (Nortel Networks)
  
• APSB08-19 Security Update available for Adobe Reader 8 and Acrobat 8 (Adobe)
  
• ASA-2009-018 Multiple Security Vulnerabilities in the Adobe Reader May Lead to E (Avaya)
  
• CORE-2008-0526: Adobe Reader Javascript Printf Buffer Overflow (CORE Security Technologies Advisories)
  
• Nortel Response to Sun Alert 249366 - Solaris 10 - Multiple Security Vulnerabili (Nortel Networks)
  
• Secunia Research: Adobe Acrobat/Reader 'util.printf()' Buffer Overflow (Secunia Research)
  
• Solution 249366: Multiple Security Vulnerabilities in the Adobe Reader May Lead (Sun)
  
• Vulnerability Note VU#593409 Adobe Reader and Acrobat util.printf() JavaScript f (US-CERT)
  
• ZDI-08-072 Adobe Acrobat PDF Javascript printf Stack Overflow Vulnerability (ZDI)