vendor:
Acrobat Viewer
by:
Shane Hird
7.5
CVSS
HIGH
Buffer Overflow
120
CWE
Product Name: Acrobat Viewer
Affected Version From: 1.3.0188
Affected Version To: 1.3.0188
Patch Exists: Yes
Related CWE: N/A
CPE: a:adobe:acrobat_viewer:4.0
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows
2000
Adobe Acrobat OCX Buffer Overrun
There is a buffer overflow in the 1.3.188 version of the Adobe Acrobat ActiveX control (pdf.ocx) that ships with Acrobat Viewer 4.0. This ActiveX control is marked 'Safe for Scripting' within Internet Explorer 4.X. Arbitrary commands may be executed if the ActiveX control is run in a malicious manner. This control from Adobe Acrobat, can be exploited through the setview method, and because ESP points to the address after the RET address, we can place arbitrary code at this point and JMP to it by RET'ing to a JMP ESP, in this case, one found in Shell32. The code simply executes CALC.EXE then calls ExitProcess to terminate the host without it crashing.
Mitigation:
Adobe has released a patch to address this vulnerability.
