Vulnerability Note VU#508357

Adobe Acrobat and Reader contain a use-after-free vulnerability in the JavaScript Doc.media.newPlayer method

Overview

The Doc.media.newPlayer method in Adobe Acrobat and Reader contains a use-after-free vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

I. Description

Adobe Reader and the Adobe Acrobat family of software are designed to create, view, and edit Portable Document Format (PDF) files. Adobe Reader is widely deployed, and the Acrobat Reader Plug-In displays PDF inside a web browser.

Adobe Reader and Acrobat support JavaScript. The newplayer() method of the Doc.media object contains a use-after-free vulnerability, which can result in an exploitable memory access violation. This vulnerability is currently being exploited in the wild. Exploit code for this vulnerability is publicly available.

II. Impact

By convincing a user to open a malicious PDF file, an attacker may be able to execute code or cause a vulnerable PDF viewer to crash. The PDF could be emailed as an attachment or hosted on a website.

III. Solution

Apply an update

This issue is addressed in Adobe Reader 9.3 and 8.2. Please see Adobe Security Bulletin APSB10-02 for details. Please also consider the following workarounds:

Enable Data Execution Prevention (DEP) in Microsoft Windows

Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can help mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts "Understanding DEP as a mitigation technology" part 1 and part 2. Use of DEP should be considered in conjunction with the application of patches or other mitigations described in this document.

Disable JavaScript in Adobe Reader and Acrobat

Disabling JavaScript prevents these vulnerabilities from being exploited and reduces attack surface. If this workaround is applied to updated versions of Adobe Reader and Acrobat, it may protect against future vulnerabilities.

To disable JavaScript in Adobe Reader:

Open Adobe Acrobat Reader.
Open the Edit menu.
Choose the Preferences... option.
Choose the JavaScript section.
Uncheck the Enable Acrobat JavaScript checkbox.

Disabling JavaScript will not resolve the vulnerabilities, it will only disable the vulnerable JavaScript component. When JavaScript is disabled, Adobe Reader and Acrobat prompt to re-enable JavaScript when opening a PDF that contains JavaScript.

Prevent Internet Explorer from automatically opening PDF documents

The installer for Adobe Reader and Acrobat configures Internet Explorer to automatically open PDF files without any user interaction. This behavior can be reverted to the safer option of prompting the user by importing the following as a .REG file:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\AcroExch.Document.7]

"EditFlags"=hex:00,00,00,00

Disable the displaying of PDF documents in the web browser

Preventing PDF documents from opening inside a web browser reduces attack surface. If this workaround is applied to updated versions of Adobe Reader and Acrobat, it may protect against future vulnerabilities.

To prevent PDF documents from automatically being opened in a web browser with Adobe Reader:

Open Adobe Acrobat Reader.
Open the Edit menu.
Choose the Preferences... option.
Choose the Internet section.
Uncheck the Display PDF in browser checkbox.

Block the use of the Doc.media.newPlayer method

This specific vulnerability can be mitigated by blocking the use of the newPlayer() method through use of the Adobe Reader and Acrobat JavaScript Blacklist Framework. Windows users can obtain a ZIP file of .REG files that disable the newPlayer() method of the Doc.media object. Upon opening a PDF that attempts to use this method, Adobe Reader and Acrobat will warn the user that a JavaScript that the document uses is disabled for security reasons. Mac and Linux users should see the Blacklist Framework document for details about how to implement the workaround.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Adobe	Vulnerable	2009-12-15	2010-01-13

References

http://www.adobe.com/support/security/advisories/apsa09-07.html
http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html
http://kb2.adobe.com/cps/532/cpsid_53237.html
http://osvdb.org/show/osvdb/60980
http://secunia.com/advisories/37690/
http://www.symantec.com/connect/blogs/zero-day-xmas-present
http://voices.washingtonpost.com/securityfix/2009/12/hackers_target_unpatched_adobe.html
http://vrt-sourcefire.blogspot.com/2009/12/this-is-what-happens-when-you-try-to-do.html

Credit

Thanks to Adobe PSIRT for reporting this vulnerability.

This document was written by Will Dormann.

Other Information

Date Public:	2009-12-14
Date First Published:	2009-12-15
Date Last Updated:	2010-06-18
CERT Advisory:
CVE-ID(s):	CVE-2009-4324
NVD-ID(s):	CVE-2009-4324
US-CERT Technical Alerts:
Metric:	65.84
Document Revision:	18

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2009 by US-CERT, a government organization
Disclaimers and copyright information Get a PDF Reader