Advisory URL: http://itsecteam.com/en/vulnerabilities/vulnerability62.htm

poc: http://itsecteam.com/files/adb_poc.zip

Date published: 2010-08-25

System Affected:

Adobe Acrobat reader 7.x

Adobe Acrobat Reader 8.x

Adobe Acrobat reader 9.x

Tested version:

Adobe Acrobat 8.1

Adobe Acrobat 9.2

Adobe Acrobat 9.3

Adobe Acrobat 9.3.4

Program Description:

 Acrobat reader is a desktop publishing software product from Adobe and PDF as a standard bed storage and transfer documentation uses. This software first portable PDF format to support. Adobe Acrobat, which now has several different versions, different versions can open and read, edit and change PDF files and produce provides. Copy it was called Adobe Rydrnam free from Adobe's website can be downloaded and can read and print PDF files provides. Acrobat Reader software and a solution for displaying text files in a special layout similar to the printed texts used to.

Vulnerability Description:

Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=00000000 ebx=00000001 ecx=02ae1314 edx=020c4bc8 esi=02adb470 edi=0012f4b4 eip=20946b4a esp=0012f414 ebp=0012f470 iopl=0         nv up ei pl zr na pe nc cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246 *** WARNING: Unable to verify checksum for C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api - AcroForm!DllUnregisterServer+0x130993: 20946b4a 8b00            mov     eax,dword ptr [eax]  ds:0023:00000000=???????? Missing image name, possible paged-out or corrupt data. Missing image name, possible paged-out or corrupt data. Missing image name, possible paged-out or corrupt data. 0:000> u AcroForm!DllUnregisterServer+0x130993: 20946b4a 8b00            mov     eax,dword ptr [eax] 20946b4c c3              ret 20946b4d 56              push    esi 20946b4e 8b742408        mov     esi,dword ptr [esp+8] 20946b52 57              push    edi 20946b53 33ff            xor     edi,edi 20946b55 393e            cmp     dword ptr [esi],edi 20946b57 7e1a            jle     AcroForm!DllUnregisterServer+0x1309bc (20946b73)

 Well we see that after Cmp eax, [eax] program gives Access violation


But the memory of this bug occurs when special characters it is injected. But because it is not possible to register them and can not be changed with the chain to locate crash can not be changed after the currently exploit this vulnerability to be a solution to this vulnerability found. Api above with the following 3 module that you can see with the address.