Vulnerability Note VU#116875

Adobe PhotoDeluxe does not adequately restrict Java execution

Original Release date: 09 Feb 2002 | Last revised: 09 Feb 2002

Overview

A vulnerability exists in Adobe PhotoDeluxe that allows a malicious web page or HTML email message viewed with Microsoft Internet Explorer to obtain directory listings or potentially download and execute arbitrary code on the local system.

Description

Adobe PhotoDeluxe is an image manipulation application for the Windows platform. PhotoDeluxe is geared towards the home user market and is bundled with a number of image capture devices, such as scanners and digital cameras. Dr. Hiromitsu Takagi has reported that Java code installed by PhotoDeluxe is given privileged access to the local system and can be exploited by a malicious web page or HTML email message viewed through Internet Explorer. Dr. Takagi's analysis is available here:

PhotoDeluxe provides a feature called "Connectables" that gives users the ability to download additional design elements from Adobe's web site. PhotoDeluxe installs Java code to support the Connecables feature, and sets or prepends the CLASSPATH environment variable to include the directory containing the code:
    CLASSPATH=C:\Program Files\PhotoDeluxe HE 3.1\AdobeConnectables
In Windows 95 and 98, CLASSPATH is set with a command in autoexec.bat. In Windows NT and 2000, CLASSPATH is set via the registry on a per-user basis.

According to the Sun Java Applet Security FAQ:
    There are two ways for an applet to be considered trusted:
    1. The applet is installed on the local hard disk, in a directory on the CLASSPATH used by the program that you are using to run the applet. Usually, this is a Java-enabled browser, but it could be the appletviewer, or other Java programs that know how to load applets.
    If an applet resides on the client's local disk, and in a directory that is on the client's CLASSPATH, then it is loaded by the file system loader. The most important differences [between applets loaded over the net and applets loaded via the file system] are
  • applets loaded via the file system are allowed to read and write files
  • applets loaded via the file system are allowed to load libraries on the client
  • applets loaded via the file system are allowed to exec processes
  • applets loaded via the file system are allowed to exit the virtual machine
  • applets loaded via the file system are not passed through the byte code verifier
For more information on the Java security model see Sun's Java documentation, particularly the Applet Security FAQ referenced above. Microsoft provides similar documentation in their Java Security Overview and a corresponding FAQ.

Since the location of the PhotoDeluxe Java code is specified in the CLASSPATH environment variable, applets that call the code have privileged access to the local system. Through Microsoft Internet Explorer, applets using the PhotoDeluxe Java code can be scripted and used to obtain directory listings on the local system. A more serious risk exists if Internet Explorer is started from within PhotoDeluxe via a Link button. In this case, the PhotoDeluxe Java code can be leveraged to download a Java archive that can in turn be used to execute arbitrary code on the local system.

Impact

By enticing a user to view a malicious web page or HTML email message, an attacker may obtain directory listings or cause arbitrary code to be downloaded and executed with the privileges of the current user. If an attacker controls DNS information, they may be able to subvert the Connectables function without the user's knowledge.

Solution

Disable Active scripting and Java
At a minimum, disable Active scripting and Java in the Internet zone and the zone used by Outlook, Outlook Express, or any other email client that uses Internet Explorer to render HTML. Instructions for disabling Active scripting and Java can be found in the CERT/CC Malicious Web Scripts FAQ.


Configure CLASSPATH Variable
Modifying the CLASSPATH environment variable to exclude the PhotoDeluxe Java code will prevent the exploitation of this vulnerability, however it will also break the Connectables feature of PhotoDeluxe.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
AdobeAffected25 Jan 200209 Feb 2002
MicrosoftUnknown28 Jan 200229 Jan 2002
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

The CERT Coordination Center thanks Dr. Hiromitsu Takagi for reporting this issue.

This document was written by Art Manion.

Other Information

  • CVE IDs: Unknown
  • Date Public: 18 Jul 2001
  • Date First Published: 09 Feb 2002
  • Date Last Updated: 09 Feb 2002
  • Severity Metric: 2.88
  • Document Revision: 51

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.