WatchGuard Live Security Service: Two New Zero Day Adobe Reader Exploits

SEVERITY: HIGH
28 April, 2009
SUMMARY:

• This vulnerability affects: Adobe Reader and Acrobat 9.1 and earlier, on Windows, Mac, *nix computers
• How an attacker exploits it: By enticing your users into viewing a maliciously crafted PDF document
• Impact: An attacker can execute code on your computer, potentially gaining control of it
• What to do: Implement the workarounds described in the Solutions section of this alert

EXPOSURE:
Yesterday, SecurityFocus released an advisory describing a new zero day Adobe Reader exploit they found in the wild. The Proof of Concept (PoC) exploit — written by some calling himself “Arr1val” — seems to leverage a flaw in the Adobe Reader function called “getAnnots()”. As it turns out, Arr1val released two new zero day exploits. The second exploit leverages another Adobe Reader function called “spell.customDictionaryOpen().” Arr1val’s code suggests he confirmed these flaws using Adobe Reader 9.1 and 8.1.4 for Linux. However, we suspect the flaws may affect all current versions of Reader running on any platform. SEVERITY: HIGH
28 April, 2009
SUMMARY:

• This vulnerability affects: Adobe Reader and Acrobat 9.1 and earlier, on Windows, Mac, *nix computers
• How an attacker exploits it: By enticing your users into viewing a maliciously crafted PDF document
• Impact: An attacker can execute code on your computer, potentially gaining control of it
• What to do: Implement the workarounds described in the Solutions section of this alert

EXPOSURE:
Yesterday, SecurityFocus released an advisory describing a new zero day Adobe Reader exploit they found in the wild. The Proof of Concept (PoC) exploit — written by some calling himself “Arr1val” — seems to leverage a flaw in the Adobe Reader function called “getAnnots()”. As it turns out, Arr1val released two new zero day exploits. The second exploit leverages another Adobe Reader function called “spell.customDictionaryOpen().” Arr1val’s code suggests he confirmed these flaws using Adobe Reader 9.1 and 8.1.4 for Linux. However, we suspect the flaws may affect all current versions of Reader running on any platform.

By enticing one of your users into downloading and opening a malicious PDF document, an attacker could exploit either of these unpatched Reader vulnerabilities to execute code on your user’s computer, with that user’s privileges. If the user had root or local administrator privileges, the attacker would gain complete control of that user’s machine.

Adobe has responded to this incident in a short blog post, saying they are investigating the issue. Since exploit code is widely available and Adobe hasn’t had time to patch yet, these flaws pose a serious risk to Adobe Reader users. We recommend you implement the workarounds described below to mitigate the risk of these dangerous zero day exploits.

SOLUTION PATH
Adobe has not had time to release a patch for these zero day vulnerabilities. However, the workarounds described below should mitigate the risk posed by the exploits currently circulating in the wild.

• Inform your users of this vulnerability. Advise them to remain wary of unsolicited PDF documents arriving via email. If they don’t absolutely need the document, and don’t trust the entity it came from, they should avoid opening it until you patch Adobe Reader.
• Use antivirus (AV) software and make sure it’s up to date. AV vendors will release signatures for these new exploits, so make sure to keep your AV software up to date.
• Disable JavaScript in Adobe Reader. Disabling JavaScript in Adobe Reader could prevent these exploits from succeeding. To disable JavaScript in Adobe Reader, click Edit => Preferences => JavaScript and then uncheck Enable Acrobat JavaScript. Keep in mind, this prevents JavaScript from running in legitimate PDF documents as well.
• Use a gateway device, like your Firebox, to block PDF files. If your users can’t download PDF files, these exploits won’t affect them. Unfortunately, doing this blocks legitimate PDF files as well. Nonetheless, depending on your business needs, you may still want to block PDF files until Adobe releases a patch.
• Use an alternative PDF reader. You can mitigate the risk of these Adobe Reader vulnerabilities by using an alternative PDF reader. Keep in mind, other PDF readers may also suffer security vulnerabilities. However, attackers seem to primarily target the popular Adobe Reader. If it meets your business needs, you may try to adopt one of the alternative PDF readers listed on this site.

We will update this alert when Adobe releases a patch.

FOR ALL WATCHGUARD USERS:
Many of WatchGuard’s Firebox models can block incoming PDF files. However, most administrators prefer to allow these file types for business purposes. Nonetheless, if PDF files are not absolutely necessary to your business, you may consider blocking them using the Firebox’s HTTP and SMTP proxy until Adobe patches.

If you decide you want to block PDF documents, follow the links below for video instructions on using your Firebox proxy’s content blocking features to block .pdf files by their file extension:

• Firebox X Edge running 10.x
• How do I block files with the FTP proxy?
• How do I block files with the HTTP proxy?
• How do I block files with the POP3 proxy?
• How do I block files with the SMTP proxy
• Firebox X Core and X Peak running Fireware 10.x
• How do I block files with the FTP proxy?
• How do I block files with the HTTP proxy?
• How do I block files with the POP3 proxy?
• How do I block files with the SMTP proxy?

STATUS:
We will update you when Adobe releases a patch. Until then, implement the workarounds described above.

REFERENCES:

• SecurityFocus Adobe Reader Advisory
• Adobe blog post
• Adobe Reader getAnnots() exploit code
• Adobe Reader spell.customDictionaryOpen() exploit code