Jul 01 2010
Adobe fix still allows “Escape from PDF”
On June 29, 2010, Adobe has published its security updates for Adobe Reader and Adobe Acrobat (APSB10-15). Among many vulnerabilities fixed this time, the noticeable one is /Launch vulnerability (CVE-2010-1240), which is said to be found by Didier Stevens. However, it is pity that the patch is not working properly.
/Launch vulnerability was released by Didier on March 29, 2010. Since then, many viruses in the wild have taken advantage of the flaw:
- Virus using /Launch exploit code in MSF
- Virus exploiting the true nature of PDF /Launch vulnerability
It takes Adobe three months to release the patch. I think it is delayed for too long.
On the blog entry, Didier confirms that Adobe has completely fixed the flaw. Thus, I decide to check the patch carefully, and the patch turns out to be incomplete.
Firstly, I check the exploited PDF file with the latest version of Adobe Reader.
Before version 9.3.3
Version 9.3.3:
The patch seems to be working. Now, what would happen if I modify the exploit code a bit?
Specifically, I add the quotes to the parameters passed to /F.
Eg: /F(cmd.exe) becomes /F(“cmd.exe”)
With the quotes added, Adobe Reader will not block the execution and the warning becomes as follow:
After pressing Open, cmd.exe will be executed!!!
So, Adobe Reader version 9.3.3 has fixed the fake warning massage, but the threat of exploit code execution still remains.
Le Manh Tung
Senior Security Researcher
[...] here's the issue, a blog post that says its an incomplete fix or patch (Thanks to fellow CNET mod, Carol) because with the v9.33, an execution can still occur. [...]
Didier Stevens confirmed on his Twitter that your bypass method works on the latest update of Adobe: http://twitter.com/DidierStevens.
Thanks for this blog entry.
Adobe behebt PoC im Reader. Oder doch nicht ?…
Adobe brachte am 29.06.2010 ein paar Updates raus in dem auch von CVE-2010-1240 die Rede ist. Hier und hier gibt es mehr Infos dazu Leider hat es Adobe nicht geschafft das Problem zu lösen. Das besondere daran ist, dass sich die Leute beschweren….
Excellent! Thanx Bkis, you are great as usual!
[...] http://blog.bkis.com/en/adobe-fix-still-allows-escape-from-pdf/ [...]
[...] O demonstratie este facuta de firma de securitate BKIS: Adobe fix still allows “Escape from PDF”. [...]
[...] un altro ricercatore, il vietnamita Le Manh Tung, ha scoperto che il rattoppo è aggirabile semplicemente mettendo le virgolette intorno al comando ostile usato [...]
I’ve just tested this with FoxIt reader and it can launch the Command prompt but not the Calc.exe. I suspect this is vulnerabke as well.
[...] [...]
Why to even use Adobe PDF software in computer ? Its a bloatware and a system hog and comes bundled with unpatched vulns. Plus, nowadays adobe has become an inherently insecure platform, take it flash or pdf. what are these guys thinking ? Buffer overflow, remote file exec,active x vulns are crippling adobe as a reliable product creator.
-Rishabh Dangwal
Adobe have a registry value to control the launch attachment permissions, at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockDown\cDefaultLaunchAttachmentPerms\tBuiltInPermList
This value contains a list of extentions and the default action (i.e. 1 allow, 3 block). One workaround is to add |.exe”:3
[...] [...]
[...] Manh Tung van BKIS is het daar niet mee eens. In een blogpost vertelt hij hoe je de aanval toch gewoon doorgang kunt laten vinden door een heel simpele [...]
[...] run embedded executables. However, BKIS Senior Security Researcher Le Manh Tung has found that the Adobe fix can be circumvented if an attacker modifies the code by adding quotes to the parameters passed to /F, for example [...]
[...] run embedded executables. However, BKIS Senior Security Researcher Le Manh Tung has found that the Adobe fix can be circumvented if an attacker modifies the code by adding quotes to the parameters passed to /F, for example [...]
[...] reports indicate that the current fix does not completely solve the problem, as proof-of-concept code bypassing [...]
[...] This post was mentioned on Twitter by Didier Stevens, Wolfgang Kandek, Timeless Prototype, Alexandre Dulaunoy, MacLemon and others. MacLemon said: If these claims are true, Adobe did a good job in keeping PDF as a Penetration Document Format. Acrobat 9.3.3 Update… http://j.mp/90cJd6 [...]
[...] contains functionality to block my /Launch action PoC, but Bkis found a bypass: just put double quotes around cmd.exe, like [...]
[...] dicha protección puede saltarse facilmente con la simple inclusión de unas comillas, según explicó el investigador Le Manh Tung.Este inconveniente fue reconocido por Adobe, prometiendo investigar [...]
[...] protección puede saltarse facilmente con la simple inclusión de unas comillas, según explicó el investigador Le Manh [...]
[...] dicha protección puede saltarse facilmente con la simple inclusión de unas comillas, según explicó el investigador Le Manh [...]
[...] Adobe fix still allows “Escape from PDF” (Vía CHW) var a2a_config = a2a_config || {}; a2a_localize = { Share: "Compartir", Save: [...]
[...] saber mais detalhes, acesse o blog de [...]
[...] dicha protección puede saltarse facilmente con la simple inclusión de unas comillas, según explicó el investigador Le Manh [...]
[...] few days after – 1st July - information on Bkis Global Task Force Blog showed that only [...]
[...] protection against embedded scripts incomplete In a post on their blog, Security firm Bkis report that the protection against /launch attacks, introduced in Adobe Reader and Acrobat with update [...]
Congrat guy!
[...] die den Fehler beheben sollten. Wie der vietnamesische Sicherheitsexperte Le Manh Tung nun herausgefunden hat, lassen sich die Sicherheitsbeschränkungen, die Adobe in das Update eingebaut hat, mit [...]
[...] reports indicate that the current fix does not completely solve the problem, as proof-of-concept code bypassing [...]
Hello,
Is there any way your releasing your PoC code, it seems really interesting.
Thank you.
Hi,
I’m interested on your method. I tried and successed with txt or jpeg file using make-pdf-embedded.py vut nothing happened when I want to use an exe file.
What is the correct procedure to call it and create a pdf with an exe (maybe proper exe and not one already located in the computer like calc or notepad)
I used it :
make-pdf-embedded.py -b test.exe test.pdf
Thanks for your answer
Hi,
In fact, with your command line (make-pdf-embedded.py -b test.exe test.pdf), the content of test.exe file is still embedded into test.pdf file, but the security policy of Adobe Reader as well as many other pdf readers will not allow you to execute .exe file embedded in pdf.
Since at default, Adobe does not allow an .exe file to be run upon opening a .pdf file, Didier’s findings about the file execution in / Launch is considered a vulnerability.
Adobe brachte am 29.06.2010 ein paar Updates raus in dem auch von CVE-2010-1240 die Rede ist. Hier und hier gibt es mehr Infos dazu Leider hat es Adobe nicht geschafft das Problem zu lösen.