full-disclosure - 0-day PDF exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 16 Oct 2007 18:27:23 +0300
From: biz4rre@...il.com
To: full-disclosure@...ts.grok.org.uk
Subject: 0-day PDF exploit

...some additional information about 0day PDF exploit PoC:

Please download and open PDF PoC _locally_ in Adobe Acrobat (not in Adobe
Acrobat ActiveX control
because of some internal restrictions within Adobe ActiveX, it may be
bypassed via:
http://seclists.org/bugtraq/2007/Oct/0213.html but i didn't made tests).

Also make sure that "mailto" handler is set to Internet Explorer 7 (any 3rd
party mail
clients is not installed).

PoC tested on WinXP SP2 Eng updated + Internet Explorer 7 + Adobe Acrobat
Reader 8.1

PoC: http://security.fedora-hosting.com/0day/pdf/pdf_poc.pdf
Details: http://security.fedora-hosting.com/0day/pdf/pdf_poc.txt

regards,
cyanid-E <biz4rre@...il.com>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/