Vulnerability Note VU#815960

Adobe Acrobat Plug-In cross domain violation

Original Release date: 03 Jan 2007 | Last revised: 30 Apr 2008

Overview

The Adobe Acrobat Plug-In fails to properly validate user-supplied content, which may allow for cross-site scripting.

Description

Adobe Acrobat Reader is software designed to view Portable Document Format (PDF) files. Adobe also distributes the Adobe Acrobat Plug-In to allow users to view PDF files inside of a web browser.

The Adobe Acrobat Plug-In PDF Open Parameters feature allows users to specify actions to take on a PDF document via URI parameters. However, the Adobe Acrobat Plug-In fails to properly validate these URI parameters for scripting code. This allows user-supplied scripts to execute within the context of the web site hosting the PDF file causing a cross-site scripting vulnerability. More information about cross-site scripting is available in CERT Advisory CA-2000-02.

Additionally, any PDF documnt can be leveraged to exploit this vulnerability, regardless of whether that document is on the local file system or a remote web server. However, web browsers typically prevent remote content from accessing resources on the local file system. This will stop scripts originating from remote sources from accessing resources on the local file system.

Impact

An attacker may be able to obtain sensitive data from a user that visits a web site hosting a PDF document. Depending on the nature of the web site, this data may include passwords, credit card numbers, and any arbitrary information provided by the user. Likewise, information stored in cookies could be stolen or corrupted.

Solution

Upgrade
This issue has been addressed in Adobe Reader 8. Adobe has issued updates for Adobe Reader versions prior to 8. See Adobe security bulletin APSB07-01 for more details. Users running operating systems that do not support Adobe Reader 8 should refer to the updates listed in Adobe Security Bulletin APSB07-01.


Until it is possible to upgrade to a fixed version of the Adobe Acrobat Plug-In, users can take the following steps to mitigate this vulnerability:

    Disable the displaying of PDF documents in the web browser

    Preventing PDF documents from opening inside a web browser may mitigate this vulnerability. If this workaround is applied to updated versions of the Adobe reader, it may mitigate future vulnerabilities.

    To prevent PDF documents from automatically being opened in a web browser:
    1. Open Adobe Acrobat Reader.
    2. Open the Edit menu.
    3. Choose the preferences option.
    4. Choose the Internet section.
    5. Un-check the "Display PDF in browser" check box.

    Disable JavaScript

    For instructions on how to disable JavaScript, please refer to the Securing Your Web Browser document.

    Do not access PDF documents from untrusted sources

    Do not open unfamiliar or unexpected PDF documents, particularly those hosted on web sites or delivered as email attachments. Please see Cyber Security Tip ST04-010.
Any website that hosts a PDF document may be leveraged to exploit this vulnerability. Web site and network Administrators can take the following steps to prevent their web sites from being leveraged in attacks using this vulnerability:
    Filter JavaScript in URLs

    Webserver administrators may be able to prevent their websites from being leveraged in attacks by deploying a reverse proxy that can filter JavaScript in URLs.

    Filter JavaScript leaving the network

    Network administrators may be able to prevent their clients being affected by this vulnerability by deploying a proxy server or firewall that can filter JavaScript in URLs.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
AdobeAffected-03 Jan 2007
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

This vulnerability was discovered and reported by Stefano Di Paola, Giorgio Fedon, and Elia Florio.

This document was written by Ryan Giobbi and Jeff Gennari.

Other Information

  • CVE IDs: CVE-2007-0045
  • Date Public: 29 Dec 2006
  • Date First Published: 03 Jan 2007
  • Date Last Updated: 30 Apr 2008
  • Severity Metric: 16.87
  • Document Revision: 120

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.