[WEB SECURITY] Adobe Acrobat Script Injection
mustlive at websecurity.com.ua
Thu Jan 21 16:54:48 EST 2010
Very interesting research about Script Injection vulnerability in Adobe's
software. And many versions of Adobe Reader and Acrobat (8.x and 9.x) are
vulnerable to this attack, as you mentioned.
But, for example, I have tested this attack in my Adobe Reader 6.0 and it
isn't vulnerable. For this reason I like old versions of Adobe Reader ;-)
(the most of new holes in Acrobat and Reader are not concern to them).
Also I liked how do you used redirectors to make XSS attacks with using of
It's very interesting variant of using of redirectors - for bypassing of
security warning in Adobe Reader and Acrobat and conducting of XSS attack. I
added it to my list of 12 attacks via redirectors, which I wrote about in
article Redirectors: the phantom menace (http://websecurity.com.ua/3495/).
There are some small typos in the text, which you can fix in your advisory
in version published at your site (if there is such one).
1. http://attacker.domain/alert.php#FDF (two times) change to
2. In Response timeline "12/10/2010" change to "12/01/2010".
Best wishes & regards,
Administrator of Websecurity web site
From: Paul Theriault <Paul.Theriault at xxxxxxxxxxxx>
Subject: [WEB SECURITY] Adobe Acrobat Script Injection
Date: Thu, 14 Jan 2010 15:07:40 +1100
> Stratsec Security Advisory: SS-2010-001
> Title: Adobe Acrobat Script Injection
> Version: 1.0
> Issue type: Script Injection
> Affected vendor: Adobe
> Affected product: Adobe Reader and Acrobat 9.2 and 8.1.7 and earlier
> Release date: 12/01/2010
> Discovered by: Paul Theriault
> Issue status: Patch available
Join us on IRC: irc.freenode.net #webappsec
Have a question? Search The Web Security Mailing List Archives:
Subscribe via RSS:
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]
Join WASC on LinkedIn
More information about the websecurity