A security researcher has uncovered yet another vulnerability in Adobe Reader that allows hackers to execute malicious code on computers by tricking their users into opening booby-trapped files.
Charlie Miller, principal security analyst at Independent Security Evaluators, disclosed the critical flaw at last week's Black Hat security conference in Las Vegas. It stems from an integer overflow in a part of the application that parses fonts, he said. That leads to a memory allocation that's too small, allowing attackers to run code of their choosing on the underlying machine. There are no reports of the flaw being targeted for malicious purposes.
[...]
Brad Arkin, senior director of product security and privacy at Adobe, said members of the company's security team attended Miller's talk and have since confirmed his claims that the vulnerability can lead to remote code execution. The team is in the process of developing a patch and deciding whether to distribute it during Adobe's next scheduled update release or as an “out-of-band” fix that would come out in the next few weeks.
Key to the decision is determining whether there are enough details available from Miller's talk for the vulnerability to be exploited in real-world attacks.
“Certainly, there's some information in the slides and screenshots of some of the crash information,” Arkin told The Register. “As we evaluate what's the right response, we're going to look in and decide is that information sufficient and if so, how long would it take for someone with malicious intent to convert that into an exploit.”
Miller's discovery is the latest to document a vulnerability in Adobe Reader that puts its users at risk of attacks that can surreptitiously install malware that steals passwords or other sensitive information. The vulnerability affects versions for Windows, Unix, and Mac OS X.
Miller discussed the unpatched bug during a demonstration of a security software tool called BitBlaze, which helps researchers analyze crash bugs. The tool, was also instrumental in helping Miller gain insights into two exploitable bugs in OpenOffice that remain unpatched. Slides from his talk are here, and the white paper is here.
------------------------------------------------------
Sadly, this vulnerability hasn't been getting the attention it desires, perhaps due to the iPhone jailbreak / exploits.
However, Adobe has just released a security advisory and a out-of-band update prenotification for Adobe Reader and Acrobat.
The updates will address critical security issues in the products, including CVE-2010-2862 which was discussed at the Black Hat USA 2010 security conference on Wednesday, July 28, 2010. Adobe expects to make these updates available during the week of August 16, 2010.The CVE above is currently in RESERVED status, but given that Charlie Miller's talk was on July 28th, this is a good indication that this update will fix the released vulnerability.
Adobe Reader/Acrobat Font Parsing Integer Overflow Vulnerability
http://secunia.com/advisories/40766
No comments:
Post a Comment