Adobe Digital Editions - exploit.company

vendor:

Digital Editions

by:

Pier-Luc Maltais

9,8

CVSS

CRITICAL

Memory Corruption

119

CWE

Product Name: Digital Editions

Affected Version From: 4.5.0 and earlier versions

Affected Version To: 4.5.0 and earlier versions

Patch Exists: YES

Related CWE: CVE-2016-0954

CPE: a:adobe:digital_editions

Metasploit: https://www.rapid7.com/db/vulnerabilities/adobe-digitaleditions-cve-2016-0954/

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Macintosh, iOS and Android

2016

Adobe Digital Editions <= 4.5.0 - Critical memory corruption

A critical memory corruption occurs when Adobe Digital Editions handle a specially crafted ExtGstate object, which could lead to remote code execution.

Mitigation:

Adobe released a patch for this vulnerability (APSB16-06)

Source

Exploit-DB raw data:

########################################################################################
 
# Title: Adobe Digital Editions <= 4.5.0 - Critical memory corruption
# Application: Adobe Digital Editions
# Version: 4.5.0 and earlier versions
# Platform: Windows, Macintosh, iOS and Android
# Software Link: http://www.adobe.com/solutions/ebook/digital-editions.html
# Date: March 8, 2016
# CVE: CVE-2016-0954
# Author: Pier-Luc Maltais from COSIG
# Contact: https://twitter.com/COSIG_
# Personal contact: https://twitter.com/plmaltais
 
########################################################################################
 
===================
Introduction:
===================
 Adobe® Digital Editions software offers an engaging way to view and manage eBooks and 
 other digital publications. Use it to download and purchase digital content, which can 
 be read both online and offline. Transfer copy-protected eBooks from your personal 
 computer to other computers or devices. Organize your eBooks into a custom library and 
 annotate pages. Digital Editions also supports industry-standard eBook formats, 
 including PDF/A and EPUB. (http://www.adobe.com/ca_fr/products/digital-editions.html)

########################################################################################
 
===================
Report Timeline:
===================
 2015-10-24: Pier-Luc Maltais from COSIG found the issue and report it to Adobe PSIRT.
 2016-03-08: Vendor fixed the issue (APSB16-06).
 2016-03-08: Release of this advisory.

########################################################################################
 
===================
Technical details:
===================
 A critical memory corruption occurs when Adobe Digital Editions handle a specially
 crafted ExtGstate object, which could lead to remote code execution.
 
########################################################################################
 
==========
POC:
==========
https://plmsecurity.net/sites/plmsecurity.net/files/APSB16-06_PoC.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39533.zip
 
########################################################################################