bugtraq - With regards to the Adobe Acrobat Reader advisory (#NISR03022004)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <007801c406d3$74317180$61d5389d@GLADIUS>
Date: Wed, 10 Mar 2004 19:11:03 -0000
From: "NGSSoftware Insight Security Research" <nisr@...tgenss.com>
To: <bugtraq@...urityfocus.com>, <NTBUGTRAQ@...TSERV.NTBUGTRAQ.COM>,
	<vulnwatch@...nwatch.org>
Subject: With regards to the Adobe Acrobat Reader advisory (#NISR03022004)

Hello all,
I've been inundated with e-mails asking whether operating systems other than 
Windows are affected by XFDF overflow. Whilst I did not state that Windows 
is the only OS affected, and I should have done, I thought it was clear, 
incorrectly, that Adobe Acrobat Reader for Windows was indeed the only one 
and not Mac, *nix, etc.

>From the original advisory:

When the xfdf file is parsed an unsafe call to sprintf is made in
preparation for outputting a debug message using OutputDebugString.

OutputDebugString is a Win32 API function, exported by kernel32.dll. 
Conseqently, the vulnerable code path will exist only in the Windows version 
of Adobe Acrobat Reader.

I hope this clears up any confusion.

Cheers,
David Litchfield
NGSSoftware/NGSConsulting
http://www.nextgenss.com/
+44(0)208 401 0070