Vulnerability Note VU#253024

Adobe Acrobat Reader for UNIX contains a buffer overflow in mailListIsPdf()

Overview

A buffer overflow in Adobe Acrobat Reader for UNIX could allow a remote attacker to execute arbitrary code.

I. Description

Adobe Acrobat Reader is an application that allows users to view PDF (Portable Document Format) files. Acrobat Reader for UNIX (Linux, Sun Solaris SPARC, IBM AIX, or HP-UX) contains a buffer overflow in the mailListIsPdf() function. This function determines if the specified input file is an email message containing a PDF attachment. When parsing the email message, this function unsafely copies user-supplied data to a fixed size buffer.

II. Impact

An attacker could execute arbitrary code with privileges of the local user. Remote exploitation could be possible by attaching a specially crafted PDF to an email message.

III. Solution

Upgrade Acrobat Reader

This issue is resolved in Acrobat Reader 5.0.10 for UNIX.

Patch acroread shell script

The iDEFENSE Security Advisory 12.14.04 contains an unofficial patch for the acroread shell script. According to the advisory, this patch verifies that the files passed to the Acrobat Reader application are PDF documents.

Systems Affected

Vendor	Status	Date Updated
Adobe Systems Incorporated	Vulnerable	15-Dec-2004
Apple Computer Inc.	Not Vulnerable	24-Feb-2005
Conectiva	Unknown	5-Jan-2005
Cray Inc.	Unknown	5-Jan-2005
Debian	Not Vulnerable	5-Jan-2005
EMC Corporation	Unknown	5-Jan-2005
Engarde	Unknown	5-Jan-2005
F5 Networks	Unknown	5-Jan-2005
FreeBSD	Vulnerable	6-Jan-2005
Fujitsu	Unknown	5-Jan-2005
Gentoo	Vulnerable	6-Jan-2005
Hewlett-Packard Company	Unknown	5-Jan-2005
Hitachi	Not Vulnerable	18-Jan-2005
IBM	Unknown	5-Jan-2005
IBM-zSeries	Unknown	5-Jan-2005
IBM eServer	Unknown	5-Jan-2005
Immunix	Unknown	5-Jan-2005
Ingrian Networks	Unknown	5-Jan-2005
Juniper Networks	Unknown	5-Jan-2005
MandrakeSoft	Unknown	5-Jan-2005
Microsoft Corporation	Unknown	5-Jan-2005
MontaVista Software	Unknown	5-Jan-2005
NEC Corporation	Not Vulnerable	9-Mar-2005
NETBSD	Unknown	5-Jan-2005
Nokia	Unknown	5-Jan-2005
Novell	Unknown	5-Jan-2005
OpenBSD	Unknown	5-Jan-2005
Openwall GNU/*/Linux	Unknown	5-Jan-2005
Redhat	Vulnerable	6-Jan-2005
SCO	Unknown	5-Jan-2005
Sequent	Unknown	5-Jan-2005
SGI	Unknown	5-Jan-2005
Sony Corporation	Unknown	5-Jan-2005
Sun Microsystems Inc.	Unknown	5-Jan-2005
SuSE Inc.	Vulnerable	6-Jan-2005
TurboLinux	Unknown	5-Jan-2005
Unisys	Unknown	5-Jan-2005
Wind River Systems Inc.	Unknown	5-Jan-2005

References

http://www.idefense.com/application/poi/display?id=161&type=vulnerabilities
http://www.adobe.com/support/techdocs/331153.html
http://secunia.com/advisories/13474/

Credit

This vulnerability was reported by Greg MacManus.

This document was written by Will Dormann, based on the information provided in the iDEFENSE Security Advisory 12.14.04 .

Other Information

Date Public	12/14/2004
Date First Published	01/20/2005 05:23:21 PM
Date Last Updated	03/09/2005
CERT Advisory
CVE Name	CAN-2004-1152
US-CERT Technical Alerts
Metric	1.02
Document Revision	7

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader