[This blog was primarily written by Xiaoning Li of Intel Labs, with assistance from Peter Szor of McAfee Labs.] In February 2013, the Adobe Product Security Incident Response Team (PSIRT) released security advisory APSA13-02. In that report they listed two vulnerabilities (CVE-2013-0640 and CVE-2013-0641) that were widely exploited. At Intel Labs and McAfee Labs we Read more…
Tags: Adobe, Adobe Reader, APSA13-02, ASLR, CVE-2013-0640, CVE-2013-0641, DEP, PDF, return-oriented programming, ROP, stack pivoting
Update on May 2 Adobe has confirmed this vulnerability and has scheduled a patch release for May 14. Looking back this year’s RSA Conference, you might have the feeling that the current threat landscape is primarily a series of advanced attacks. This concept includes well-known advanced persistent threats (APTs) and zero-day vulnerability exploits. To Read more…
Tags: 0 day vulnerability, Adobe Reader, Advanced Persistent Threat, APT, detection, email tracking service, exploit, PDF, tracking usage, Zero-Day
As promised in our previous blog entry for the recent Adobe Reader PDF zero-day attack, we now offer more technical details on this Reader “sandbox-escape” plan. In order to help readers understand what’s going on there, we first need to provide some background. Adobe Reader’s Sandbox Architecture The Adobe Reader sandbox consists of two processes: Read more…
Tags: ASLR, CVE-2013-0633, CVE-2013-0634, DEP, exploit, exploitation, PDF, sandbox, Zero-Day
The winter of 2013 seems to be “zero-day” season. Right after my colleague Haifei Li analyzed the powerful Flash zero day last week, Adobe sent a security alert for another zero-day attack targeting the latest (and earlier) versions of Adobe Reader. Unlike Internet Explorer zero-day exploits that we have seen in the past, this Reader Read more…
Tags: Adobe Reader, broker, JavaScript, PDF, ROP, sandbox, shellcode, XFA, Zero-Day
Last week I kicked off a series of blogs with a discussion of how an effective IPS solution can fight obfuscation techniques by malware. This week, we’ll look at how JavaScript poses a danger when combined with PDF files. One of the easiest and most powerful ways to customize PDF files is by using JavaScript. Read more…
Tags: encoding, evasion, JavaScript, Obfuscation, PDF
Recently a critical vulnerability has been identified in Adobe Reader X and Adobe Acrobat X Versions 10.1.1 and earlier for Windows and Mac OS, Reader 9.4.6 and Reader 9.x Versions for Unix. This zero-day vulnerability (CVE-2011-2462) could allow an attacker to execute arbitrary code and silently take the control of a victim’s machine. This flaw is currently Read more…
Tags: Adobe, Data Protection, PDF, Zero-Day
Posts tagged under PDF