A vulnerability exists in Adobe PhotoDeluxe that allows a malicious web page or HTML email message viewed with Microsoft Internet Explorer to obtain directory listings or potentially download and execute arbitrary code on the local system.
Adobe PhotoDeluxe is an image manipulation application for the Windows platform. PhotoDeluxe is geared towards the home user market and is bundled with a number of image capture devices, such as scanners and digital cameras. Dr. Hiromitsu Takagi has reported that Java code installed by PhotoDeluxe is given privileged access to the local system and can be exploited by a malicious web page or HTML email message viewed through Internet Explorer. Dr. Takagi's analysis is available here:
Since the location of the PhotoDeluxe Java code is specified in the CLASSPATH environment variable, applets that call the code have privileged access to the local system. Through Microsoft Internet Explorer, applets using the PhotoDeluxe Java code can be scripted and used to obtain directory listings on the local system. A more serious risk exists if Internet Explorer is started from within PhotoDeluxe via a Link button. In this case, the PhotoDeluxe Java code can be leveraged to download a Java archive that can in turn be used to execute arbitrary code on the local system.
By enticing a user to view a malicious web page or HTML email message, an attacker may obtain directory listings or cause arbitrary code to be downloaded and executed with the privileges of the current user. If an attacker controls DNS information, they may be able to subvert the Connectables function without the user's knowledge.
Disable Active scripting and Java
The CERT Coordination Center thanks Dr. Hiromitsu Takagi for reporting this issue.
This document was written by Art Manion.
|Date First Published:||2002-02-09|
|Date Last Updated:||2002-02-09 22:15 UTC|