lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <4D51C32A.40006@fibertel.com.ar> Date: Tue, 08 Feb 2011 19:26:50 -0300 From: root <root_@...ertel.com.ar> To: full-disclosure@...ts.grok.org.uk Subject: Re: ZDI-11-072: Adobe Reader BMP ColorData Remote Code Execution Vulnerability On 02/08/2011 06:40 PM, ZDI Disclosures wrote: > ZDI-11-072: Adobe Reader BMP ColorData Remote Code Execution Vulnerability > > http://www.zerodayinitiative.com/advisories/ZDI-11-072 > > February 8, 2011 > > -- CVE ID: > CVE-2011-0599 > > -- CVSS: > 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C) > > -- Affected Vendors: > Adobe > > -- Affected Products: > Adobe Reader > > -- TippingPoint(TM) IPS Customer Protection: > TippingPoint IPS customers have been protected against this > vulnerability by Digital Vaccine protection filter ID 10800. > For further product information on the TippingPoint IPS, visit: > > http://www.tippingpoint.com > > -- Vulnerability Details: > This vulnerability allows remote attackers to execute arbitrary code on > vulnerable installations of Adobe Reader. User interaction is required > to exploit this vulnerability in that the target must visit a malicious > page or open a malicious file. > > The flaw exists within the Bitmap parsing component of rt3d.dll. When > allocating a destination buffer for handling 4/8-bit RLE compressed > bitmaps, the process uses the bitmap bits per pixel and number of colors > values directly. A pointer is created based on the specified color > depth, which can then be used to copy user supplied data into the > fixed-length color data buffer on the heap. A remote attacker can > exploit this vulnerability to execute arbitrary code under the context > of the user. > > -- Vendor Response: > Adobe has issued an update to correct this vulnerability. More > details can be found at: > > http://www.adobe.com/support/security/bulletins/apsb11-03.html > > -- Disclosure Timeline: > 2010-11-15 - Vulnerability reported to vendor > 2011-02-08 - Coordinated public release of advisory > > -- Credit: > This vulnerability was discovered by: > * Peter Vreugdenhil ( http://vreugdenhilresearch.nl ) > > -- About the Zero Day Initiative (ZDI): > Established by TippingPoint, The Zero Day Initiative (ZDI) represents > a best-of-breed model for rewarding security researchers for responsibly > disclosing discovered vulnerabilities. > > Researchers interested in getting paid for their security research > through the ZDI can find more information and sign-up at: > > http://www.zerodayinitiative.com > > The ZDI is unique in how the acquired vulnerability information is > used. TippingPoint does not re-sell the vulnerability details or any > exploit code. Instead, upon notifying the affected product vendor, > TippingPoint provides its customers with zero day protection through > its intrusion prevention technology. Explicit details regarding the > specifics of the vulnerability are not exposed to any parties until > an official vendor patch is publicly available. Furthermore, with the > altruistic aim of helping to secure a broader user base, TippingPoint > provides this vulnerability information confidentially to security > vendors (including competitors) who have a vulnerability protection or > mitigation product. > > Our vulnerability disclosure policy is available online at: > > http://www.zerodayinitiative.com/advisories/disclosure_policy/ > > Follow the ZDI on Twitter: > > http://twitter.com/thezdi > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > Haha code execution on *every* image format, how do you manage to do that? it was some kind of requirement, I suppose. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists