Vulnerability Note VU#815960

Adobe Acrobat Plug-In cross domain violation

The Adobe Acrobat Plug-In PDF Open Parameters feature allows users to specify actions to take on a PDF document via URI parameters. However, the Adobe Acrobat Plug-In fails to properly validate these URI parameters for scripting code. This allows user-supplied scripts to execute within the context of the web site hosting the PDF file causing a cross-site scripting vulnerability. More information about cross-site scripting is available in CERT Advisory CA-2000-02.

Additionally, any PDF documnt can be leveraged to exploit this vulnerability, regardless of whether that document is on the local file system or a remote web server. However, web browsers typically prevent remote content from accessing resources on the local file system. This will stop scripts originating from remote sources from accessing resources on the local file system.

II. Impact

This issue has been addressed in Adobe Reader 8. Adobe has issued updates for Adobe Reader versions prior to 8. See Adobe security bulletin APSB07-01 for more details. Users running operating systems that do not support Adobe Reader 8 should refer to the updates listed in Adobe Security Bulletin APSB07-01.

Until it is possible to upgrade to a fixed version of the Adobe Acrobat Plug-In, users can take the following steps to mitigate this vulnerability:

Disable the displaying of PDF documents in the web browser

Preventing PDF documents from opening inside a web browser may mitigate this vulnerability. If this workaround is applied to updated versions of the Adobe reader, it may mitigate future vulnerabilities.

To prevent PDF documents from automatically being opened in a web browser:

1. Open Adobe Acrobat Reader.
2. Open the Edit menu.
3. Choose the preferences option.
4. Choose the Internet section.
5. Un-check the "Display PDF in browser" check box.

Disable JavaScript

For instructions on how to disable JavaScript, please refer to the Securing Your Web Browser document.

Do not access PDF documents from untrusted sources

Do not open unfamiliar or unexpected PDF documents, particularly those hosted on web sites or delivered as email attachments. Please see Cyber Security Tip ST04-010.

Filter JavaScript in URLs

Webserver administrators may be able to prevent their websites from being leveraged in attacks by deploying a reverse proxy that can filter JavaScript in URLs.

Filter JavaScript leaving the network

Network administrators may be able to prevent their clients being affected by this vulnerability by deploying a proxy server or firewall that can filter JavaScript in URLs.

http://www.cert.org/advisories/CA-2000-02.html
http://www.adobe.com/support/security/
http://secunia.com/advisories/23691/advisories/apsa07-01.html
http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
http://www.wisec.it/vulns.php?page=9
http://secunia.com/advisories/23483/
http://www.adobe.com/devnet/acrobat/pdfs/PDFOpenParameters.pdf
http://en.wikipedia.org/wiki/Reverse_proxy
http://www.securityfocus.com/bid/21858
http://secunia.com/advisories/23882/
http://secunia.com/advisories/23877/
http://secunia.com/advisories/23812/
http://www.mozilla.org/security/announce/2007/mfsa2007-02.html
http://secunia.com/advisories/24533/

Credit

This vulnerability was discovered and reported by Stefano Di Paola, Giorgio Fedon, and Elia Florio.

This document was written by Ryan Giobbi and Jeff Gennari.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.