bugtraq - Re: Vulnerability (critical): Digital signature for Adobe Acrobat/Reader plug-in can be forged

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200303261835.h2QIZD6g027059@www.harkless.org>
Date: Wed, 26 Mar 2003 10:35:13 -0800
From: "Dan Harkless" <bugtraq@...kless.org>
To: bugtraq@...urityfocus.com
Subject: Re: Vulnerability (critical): Digital signature for Adobe Acrobat/Reader plug-in can be forged

Vladimir Katalov <info@...omsoft.com> writes:
>   We were able to write a 'fake' plug-in "fakecert.api" which does
>   nothing, but being loaded by Adobe Acrobat (and Reader) 4 and 5
>   as the certified one even in 'trusted' mode, though we don't have
>   a 'Reader Integration Key' (this plug-in has been provided only to
>   Adobe and CERT). When installed into 'plug_ins' subfolder, plug-in
>   is being loaded every time when Adobe Acrobat (or Reader) starts, and
>   shows a simple message box.

For those of us not familiar with Acrobat plugins, is there some facility
for the program retrieving/installing plugins automatically, or, to exploit
this would you need to entice a user to manually place your .api file in
their "plug_ins" directory (or run an installer program that would do so, in
which case you could run arbitrary code anyway in the installer)?

--
Dan Harkless
bugtraq@...kless.org
http://harkless.org/dan/