Vulnerability Note VU#198908

Adobe Acrobat AcroPDF ActiveX control fails to properly handle malformed input

Overview

The Adobe Acrobat AcroPDF ActiveX control fails to properly handle malformed input to its methods. This could allow an attacker to cause the application using the ActiveX control to crash.

I. Description

Adobe Acrobat and Adobe Reader provide an ActiveX control to allow applications such as Internet Explorer to open PDF files. The control, which is provided by the file AcroPDF.dll, fails to properly handle input to its methods. By calling certain methods with specific input, the application hosting the ActiveX control can crash.

More information about this issue can be found in Adobe Security bulletin APSB06-20.

II. Impact

By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to cause Internet Explorer (or any program using the Adobe AcroPDF control) to crash. Note that this crash does not appear to be exploitable to execute arbitrary code.

III. Solution

Upgrade Adobe Reader as prescribed by Adobe

Adobe has addressed this issue in Adobe Reader 8. Users should upgrade to Adobe Reader 8 as soon as possible.

Users who are unable to upgrade to Adobe Reader 8 should upgrade to an unaffected version of the AcroPDF ActiveX control. Instrcutions on how to upgrade the AcroPDF ActiveX control are listed in Adobe Security bulletin APSB06-20.

Disable the AcroPDF ActiveX control

According to Adobe Security advisory APSA06-20, the AcroPDF ActiveX control can be disabled by taking the following steps:

Exit Internet Explorer and Adobe Reader.
Browse to <volume>:\Program Files\Adobe\Acrobat 7.0\ActiveX. Note: If you did not install Acrobat to the default location, browse to the location of your Acrobat 7.0 folder.
Select AcroPDF.dll and delete it.

Disable the AcroPDF ActiveX control in Internet Explorer

The Adobe AcroPDF ActiveX control can be disabled in Internet Explorer by setting the kill bit for the following CLSID:

{CA8A9780-280D-11CF-A24D-444553540000}

More information about how to set the kill bit is available in Microsoft Support Document 240797. Alternatively, the following text can be saved as a .REG file and imported to set the kill bit for this control:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\

{CA8A9780-280D-11CF-A24D-444553540000}

]

"Compatibility Flags"=dword:00000400

Disable ActiveX

Disabling ActiveX controls in the Internet Zone (or any zone used by an attacker) appears to prevent exploitation of this and other ActiveX vulnerabilities. Instructions for disabling ActiveX in the Internet Zone can be found in the "Securing Your Web Browser" document.�

Systems Affected

Vendor	Status	Date Updated
Adobe	Vulnerable	7-Dec-2006

References

http://www.adobe.com/support/security/bulletins/apsb06-20.html
http://www.adobe.com/support/security/advisories/apsa06-02.html
http://www.adobe.com/products/acrobat/readstep2.html
http://www.securityfocus.com/bid/21155
http://www.frsirt.com/english/advisories/2006/4751
http://secunia.com/advisories/23138/
http://www.securityfocus.com/bid/22856

Credit

This vulnerability was reported by Michal Bucko.

This document was written by Will Dormann.

Other Information

Date Public	11/17/2006
Date First Published	11/30/2006 12:33:44 PM
Date Last Updated	03/19/2007
CERT Advisory
CVE Name	CVE-2006-6027
Metric	9.32
Document Revision	18

If you have feedback, comments, or additional information about this vulnerability, please send us email.