[WEB SECURITY] Adobe Acrobat Script Injection

MustLive mustlive at websecurity.com.ua
Thu Jan 21 16:54:48 EST 2010


Hello Paul!

Very interesting research about Script Injection vulnerability in Adobe's
software. And many versions of Adobe Reader and Acrobat (8.x and 9.x) are
vulnerable to this attack, as you mentioned.

But, for example, I have tested this attack in my Adobe Reader 6.0 and it
isn't vulnerable. For this reason I like old versions of Adobe Reader ;-)
(the most of new holes in Acrobat and Reader are not concern to them).

Also I liked how do you used redirectors to make XSS attacks with using of
this vulnerability.

It's very interesting variant of using of redirectors - for bypassing of
security warning in Adobe Reader and Acrobat and conducting of XSS attack. I
added it to my list of 12 attacks via redirectors, which I wrote about in
article Redirectors: the phantom menace (http://websecurity.com.ua/3495/).

P.S.

There are some small typos in the text, which you can fix in your advisory
in version published at your site (if there is such one).

1. http://attacker.domain/alert.php#FDF (two times) change to
http://attacker.domain/alert.fdf#FDF.

2. In Response timeline "12/10/2010" change to "12/01/2010".

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

From: Paul Theriault <Paul.Theriault at xxxxxxxxxxxx>
Subject: [WEB SECURITY] Adobe Acrobat Script Injection
Date: Thu, 14 Jan 2010 15:07:40 +1100

> ================================================================================
> Stratsec Security Advisory: SS-2010-001
> ================================================================================
>
> Title:    Adobe Acrobat Script Injection
> Version:   1.0
> Issue type:   Script Injection
> Affected vendor:  Adobe
> Affected product: Adobe Reader and Acrobat 9.2 and 8.1.7 and earlier
> versions.
> Release date:     12/01/2010
> Discovered by:    Paul Theriault
> Issue status:     Patch available
>
> ================================================================================


----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

Join WASC on LinkedIn
http://www.linkedin.com/e/gis/83336/4B20E4374DBA



More information about the websecurity mailing list