Adobe SVG Viewer Alert Method Zone/Domain Bypass Vulnerability
BID:8784
Info
Adobe SVG Viewer Alert Method Zone/Domain Bypass Vulnerability
| Bugtraq ID: | 8784 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 07 2003 12:00AM |
| Updated: | Oct 07 2003 12:00AM |
| Credit: | Discovery is credited to GreyMagic Software. |
| Vulnerable: |
Adobe SVG Viewer 3.0 |
| Not Vulnerable: |
Adobe SVG Viewer 3.0 1 |
Discussion
Adobe SVG Viewer Alert Method Zone/Domain Bypass Vulnerability
The Adobe SVG Viewer (ASV) alert() method is prone to a vulnerability that could permit script code to be executed in the context of a foreign domain or another Security Zone (in the case of the viewer being included as a plug-in for Internet Explorer). This could permit malicious script code to access the properties of foreign domains or to execute with the relaxed security restrictions associated with other browser Security Zones.
Potential attacks include theft of cookie-based authentication credentials from foreign domains, as well as controlling how sites are rendered to users. Executing malicious script in other Security Zones, such as My Computer, poses a more serious risk as it may facilitate attacks which allow local files to be read or written to and execution of arbitrary code. The attack vectors may vary depending on whether the viewer is operating on its own or used as a plug-in for Internet Explorer (or other browsers).
ASV 3.0 and prior are reported to be prone to this vulnerability.
The Adobe SVG Viewer (ASV) alert() method is prone to a vulnerability that could permit script code to be executed in the context of a foreign domain or another Security Zone (in the case of the viewer being included as a plug-in for Internet Explorer). This could permit malicious script code to access the properties of foreign domains or to execute with the relaxed security restrictions associated with other browser Security Zones.
Potential attacks include theft of cookie-based authentication credentials from foreign domains, as well as controlling how sites are rendered to users. Executing malicious script in other Security Zones, such as My Computer, poses a more serious risk as it may facilitate attacks which allow local files to be read or written to and execution of arbitrary code. The attack vectors may vary depending on whether the viewer is operating on its own or used as a plug-in for Internet Explorer (or other browsers).
ASV 3.0 and prior are reported to be prone to this vulnerability.
Exploit / POC
Adobe SVG Viewer Alert Method Zone/Domain Bypass Vulnerability
The following example was provided:
alert("Press OK to continue...");
// At this point, another thread changes the parent URL to the victim domain
parent.alert(parent.location.href); // Outputs victim domain once the user pressed OK
Proof-of-concepts have been made available on the following web page:
http://sec.greymagic.com/adv/gm004-mc/
The following example was provided:
alert("Press OK to continue...");
// At this point, another thread changes the parent URL to the victim domain
parent.alert(parent.location.href); // Outputs victim domain once the user pressed OK
Proof-of-concepts have been made available on the following web page:
http://sec.greymagic.com/adv/gm004-mc/
Solution / Fix
Adobe SVG Viewer Alert Method Zone/Domain Bypass Vulnerability
Solution:
Adobe has addressed this and other issues in ASV 3.01. Users are advised to upgrade.
Adobe SVG Viewer 3.0
Solution:
Adobe has addressed this and other issues in ASV 3.01. Users are advised to upgrade.
Adobe SVG Viewer 3.0
-
Adobe ASV 3.01
http://www.adobe.com/svg/viewer/install/mainframed.html