|
|
Needless to further remind everyone, zero-day attacks are the preferred choice of cyber criminals and will continue to be so in 2009. If the recent W32/Conficker.worm (MS08-087) and Exploit-XMLhttp.d (MS08-078, MS09-002) were not good enough to prove our point, here is another one.
At the turn of 2009, malicious PDF documents were discovered to be exploiting a 0-day vulnerability affecting Adobe Reader 8,x and 9.x. In parsing a specially crafted embedded object, a bug in the reader allowed the attacker to overwrite memory at an arbitrary location. The attacks, found in the field, use the infamous “HeapSpray” method via JavaScript to achieve control of code execution (see below):

In the above image, the eax register is specially crafted to point to the malicious shellcode that installs a trojan. When successful, the attack installs a backdoor to enforce remote control and monitoring on infected systems. Further characteristics of this backdor and detection details are posted at http://vil.nai.com/vil/content/v_153842.htm
While the distribution of this exploit thus far appears to be targeted, new variants are expected as more information is made public. As with the Conficker experience, the lack of good patch management is a very worrying trend that deserves more attention from IT security practitioners. Adobe is expected to release a patch very soon:
http://www.adobe.com/support/security/advisories/apsa09-01.html
|
|
i thinx adobe update it now
thanx dear
Adobe’s Patch Is Released for Acrobat Reader 8.x & 9.x
Adobe recommends Adobe Reader users update to Adobe Reader 9.1, available here:
http://get.adobe.com/reader/
Acrobat 9
Adobe recommends Acrobat 9 Standard and Acrobat 9 Pro users on Windows update to Acrobat 9.1, available at the following URLs:
http://www.adobe.com/support/downloads/detail.jsp?ftpID=4375
http://www.adobe.com/support/downloads/detail.jsp?ftpID=4382
Adobe recommends Acrobat 9 Pro Extended users on Windows update to Acrobat 9.1, available here:
http://www.adobe.com/support/downloads/detail.jsp?ftpID=4381
Adobe recommends Acrobat 9 Pro users on Macintosh update to Acrobat 9.1, available here:
http://www.adobe.com/support/downloads/detail.jsp?ftpID=4374
Still no talk of the vulnerability of Acrobat 6.x
There are a few new PoC at milworm that do not appear to be detected by VirusScan using the most recent DAT release. I’ve submitted some samples to AVERT in hope that an updated DAT will come out soon. According to http://secunia.com/blog/44/, they created some samples that proof disabling javascript in Acrobat/Reader does not mitigate the risk. VirusScan buffer overflow protection may help for users running Internet Explorer, but not firefox users.
There is exploit code (in the form of a perl script) at milworm. The script will generate a pdf file that contains the exploit. As of last night, 2 out of 39 AV programs on virustotal detect the milworm file as a threat. When tested on acrobat 6 running on Windows 98, acrobat displays a message that the file is corrupt and can’t be read. It does not crash. I take that as an indication that Acrobat 6 is not vulnerable to the exploit. Windows-98 wins again over NT-based OS’s.
Disabling Javascript may not help at all. I’ve noticed if you launch a “javascript” enabled PDF, it just keeps bugging you to turn it back on… Great fix for a corporate environment where users will agree to anything quickly if it’ll stop them being bugged!
Will Mcafee be releasing a HIPS signature for this? If so when is it planning on being released?
The CERT advisory states that disabling javascript in acrobat reader “may” prevent exploitation. What does “may” mean? Also if users have stripped down rights what would this do to the impact of exploit?
Larry, the vulnerability used by Conficker was exploited in the wild as a 0-day before the out-of-cycle patch was released, more notable by Spy-Agent.da.
http://www.labs.com/research/blog/index.php/2008/10/24/first-glimpse-into-ms08-067-exploits-in-the-wild/
Can anyone confirm (or can anyone post a reference) that Acrobat version 6 is, or is not, affected by this exploit or has this vulnerability? Is there any example code available for vulnerability testing?
Conficker wasn’t a zero-day.
Submit your own comments / message for this post