Vulnerability Note VU#257117

Adobe Acrobat and Reader contain vulnerabilities in multiple Document Object JavaScript methods

Original Release date: 13 Oct 2009 | Last revised: 27 Oct 2009

Overview

A vulnerability in the way Adobe Acrobat and Reader enforce privileges on JavaScript in PDF files could allow arbitrary files to be written to the local file system of an affected system.

Description

Adobe Reader and the Adobe Acrobat family of software are designed to create, view, and edit Portable Document Format (PDF) files. Adobe Reader is widely deployed, and the Acrobat Reader Plug-In displays PDF inside a web browser.

Adobe Reader and Acrobat support JavaScript. According to the JavaScript for Acrobat API reference, certain methods are designed to be unavailable or have security restrictions in a non-privileged context. As a result, it should not be possible to call these methods from non-privileged events, such as page open or mouse-up.

Adobe Acrobat and Reader fail to enforce the Privileged Context and Safe Path restrictions on certain JavaScript methods. This failure results in a vulnerability that allows methods that accept a cPath parameter to write to an arbitrary file extension and arbitrary path rather than those intended to be limited by the Safe Path restriction.

Impact

By convincing a user to open a specially crafted PDF file, an attacker may be able to execute certain privileged JavaScript methods that can be used to create arbitrary files and folders on an affected system, subject to the normal permissions of the victim user.

Solution

Update
Adobe has released updates to address this issue. Users are encouraged to read Adobe Security Bulletin APSB09-15 and update vulnerable versions of Adobe Reader and Acrobat.

Enable Data Execution Prevention (DEP) in Microsoft Windows


Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts "Understanding DEP as a mitigation technology" part 1 and part 2. Use of DEP should be considered in conjunction with the application of patches or other mitigations described in this document.

Disable JavaScript in Adobe Reader and Acrobat

Disabling JavaScript prevents these vulnerabilities from being exploited and reduces attack surface. If this workaround is applied to updated versions of Adobe Reader and Acrobat, it may protect against future vulnerabilities.

To disable JavaScript in Adobe Reader:

  1. Open Adobe Acrobat Reader.
  2. Open the Edit menu.
  3. Choose the Preferences... option.
  4. Choose the JavaScript section.
  5. Uncheck the Enable Acrobat JavaScript check box.
Disabling JavaScript will not resolve the vulnerabilities, it will only disable the vulnerable JavaScript component. When JavaScript is disabled, Adobe Reader and Acrobat prompt to re-enable JavaScript when opening a PDF that contains JavaScript.

Prevent Internet Explorer from automatically opening PDF documents

The installer for Adobe Reader and Acrobat configures Internet Explorer to automatically open PDF files without any user interaction. This behavior can be reverted to the safer option of prompting the user by importing the following as a .REG file:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\AcroExch.Document.7]
"EditFlags"=hex:00,00,00,00

Disable the displaying of PDF documents in the web browser

Preventing PDF documents from opening inside a web browser reduces attack surface. If this workaround is applied to updated versions of Adobe Reader and Acrobat, it may protect against future vulnerabilities.

To prevent PDF documents from automatically being opened in a web browser with Adobe Reader:
  1. Open Adobe Acrobat Reader.
  2. Open the Edit menu.
  3. Choose the Preferences... option.
  4. Choose the Internet section.
  5. Uncheck the Display PDF in browser check box.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
AdobeAffected04 Sep 200913 Oct 2009
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Richard van Eeden of IOActive, for reporting this issue.

This document was written by Chad R Dougherty.

Other Information

  • CVE IDs: CVE-2009-2993
  • Date Public: 01 Sep 2009
  • Date First Published: 13 Oct 2009
  • Date Last Updated: 27 Oct 2009
  • Document Revision: 15

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.