Sometimes the only thing between you and a successful exploit is an information leak. While I see my fair share of information disclosure bugs on the job, it’s not every day that I see one that is so clean and elegant. Then again, it’s not every day I get the privilege of looking at some of , but first, here’s a quick video showing the bug in action.
The Vulnerability
The issue exists due to the way Adobe Reader handles the ID tag within the PDF trailer. The problem is that when processing the array values for the ID tag, the application does not anticipate anything over 0x100 bytes. With this knowledge and some JavaScript in hand, an attacker can leverage this to disclose the base address of Annots.api.
What exactly are we talking about?
If you pop open a PDF document in an editor, chances are that at the bottom, you’ll see a File Trailer that looks something like this:
Figure 1 - Example PDF Trailer
According to Adobe’s this along with other vulnerabilities that could allow remote code execution, including one bug that was being actively exploited. Getting code execution on modern applications typically requires multiple steps, and leaking memory addresses is often the first step towards a full exploit chain. Combine this bug with something that allows code execution and a sandbox escape, and you could have a full compromise. You should definitely apply the security patch to all affected systems as soon as possible.
You can find me on Twitter at for the latest in exploit techniques and security patches.
SOCIAL SHARE CARD GENERATOR