This site uses cookies.
Some of these cookies are essential to the operation of the site,
while others help to improve your experience by providing insights into how the site is being used.
For more information, please see the ProZ.com privacy policy.
Charlotte Blank Germany Local time: 01:09 Czech to German + ...
Jul 18, 2004
Hi all,
this is what I just found on http://www.idefense.com Though it is already a few day old and maybe some of you know it I think it should be made public here:
Adobe Reader is a program used to display Portable Documen... See more
Hi all,
this is what I just found on http://www.idefense.com Though it is already a few day old and maybe some of you know it I think it should be made public here:
Adobe Reader is a program used to display Portable Document Format (PDF) documents.
II. DESCRIPTION
Exploitation of a buffer overflow vulnerability in Adobe Reader 6.0 could allow remote attackers to execute arbitrary code.
The problem specifically exists within a routine that is responsible for splitting the filename path into multiple components. Due to a parsing error involving NULL characters, an attacker can force Adobe Reader to open a file containing an unhandled file extension. If an overly long extension is supplied, a stack based overflow occurs.
III. ANALYSIS
Successful exploitation allows an attacker to execute arbitrary code under the privileges of the local user. Remote exploitation is possible by sending a specially crafted e-mail and attaching the malicious PDF document.
IV. DETECTION
iDEFENSE has confirmed that Adobe Acrobat Reader version 6.0.1 is vulnerable. It is suspected that other versions of Adobe Acrobat Reader are vulnerable as well. Adobe Acrobat may also be vulnerable.
V. VENDOR RESPONSE
Coordinated public disclosure of this vulnerability did not occur. According to Adobe, the vulnerability was patched on June 7, 2004 when Adobe Reader 6.0.2 was released. A vendor security advisory was not released but the following statement was included in a changelog (http://www.adobe.com/support/techdocs/34222.htm) detailing the changes included in the 6.0.2 update:
"Security update to further restrict malicious code execution."
Adobe's official response is below:
"Adobe Systems Incorporated recommends that users update to the latest release of Adobe Acrobat and the free Adobe Reader, version 6.0.2. Instructions and further information is available at: http://www.adobe.com/support/techdocs/34222.htm."
VI. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2004-0632 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.
VII. DISCLOSURE TIMELINE
02/02/2004 Exploit discovered by iDEFENSE 03/11/2004 Initial vendor notification 03/11/2004 Initial vendor response 03/11/2004 iDEFENSE clients notified 06/07/2004 Vendor update released 07/12/2004 Public Disclosure
VIII. CREDIT
Greg MacManus (iDEFENSE Labs) is credited with this discovery.
Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email [email protected] for permission.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. ▲ Collapse
Subject:
Comment:
The contents of this post will automatically be included in the ticket generated. Please add any additional comments or explanation (optional)
Sol United States Local time: 19:09 Spanish to English + ...
Thank-you
Jul 25, 2004
Updating is very simple; I just did it. If you have version 6.01, just go to "Help", "Updates...".
Subject:
Comment:
The contents of this post will automatically be included in the ticket generated. Please add any additional comments or explanation (optional)
Create your account in minutes, and start working! 3-month trial for agencies, and free for freelancers!
The system lets you keep client/vendor database, with contacts and rates, manage projects and assign jobs to vendors, issue invoices, track payments, store and manage project files, generate business reports on turnover profit per client/manager etc.
The leading translation software used by over 270,000 translators.
Designed with your feedback in mind, Trados Studio 2022 delivers an unrivalled, powerful desktop
and cloud solution, empowering you to work in the most efficient and cost-effective way.