Adobe Acrobat and Reader contain a use-after-free vulnerability in the JavaScript Doc.media.newPlayer method

Overview

The Doc.media.newPlayer method in Adobe Acrobat and Reader contains a use-after-free vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

Description

Adobe Reader and the Adobe Acrobat family of software are designed to create, view, and edit Portable Document Format (PDF) files. Adobe Reader is widely deployed, and the Acrobat Reader Plug-In displays PDF inside a web browser.

Adobe Reader and Acrobat support JavaScript. The newplayer() method of the Doc.media object contains a use-after-free vulnerability, which can result in an exploitable memory access violation. This vulnerability is currently being exploited in the wild. Exploit code for this vulnerability is publicly available.

---

Impact

By convincing a user to open a malicious PDF file, an attacker may be able to execute code or cause a vulnerable PDF viewer to crash. The PDF could be emailed as an attachment or hosted on a website.

---

Solution

Apply an update
This issue is addressed in Adobe Reader 9.3 and 8.2. Please see Adobe Security Bulletin APSB10-02 for details. Please also consider the following workarounds:

---

Enable Data Execution Prevention (DEP) in Microsoft Windows

Consider enabling Data Execution Prevention (DEP) in supported versions of Windows. DEP should not be treated as a complete workaround, but it can help mitigate the execution of attacker-supplied code in some cases. Microsoft has published detailed technical information about DEP in Security Research & Defense blog posts “Understanding DEP as a mitigation technology” part 1 and part 2. Use of DEP should be considered in conjunction with the application of patches or other mitigations described in this document**.**

Disable JavaScript in Adobe Reader and Acrobat

Disabling JavaScript prevents these vulnerabilities from being exploited and reduces attack surface. If this workaround is applied to updated versions of Adobe Reader and Acrobat, it may protect against future vulnerabilities.

To disable JavaScript in Adobe Reader:

1. Open Adobe Acrobat Reader.
2. Open the Edit menu.
3. Choose the Preferences... option.
4. Choose the JavaScript section.
5. Uncheck the Enable Acrobat JavaScript checkbox.
   Disabling JavaScript will not resolve the vulnerabilities, it will only disable the vulnerable JavaScript component. When JavaScript is disabled, Adobe Reader and Acrobat prompt to re-enable JavaScript when opening a PDF that contains JavaScript.

Prevent Internet Explorer from automatically opening PDF documents

The installer for Adobe Reader and Acrobat configures Internet Explorer to automatically open PDF files without any user interaction. This behavior can be reverted to the safer option of prompting the user by importing the following as a .REG file:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\AcroExch.Document.7]
"EditFlags"=hex:00,00,00,00
Disable the displaying of PDF documents in the web browser

Preventing PDF documents from opening inside a web browser reduces attack surface. If this workaround is applied to updated versions of Adobe Reader and Acrobat, it may protect against future vulnerabilities.

To prevent PDF documents from automatically being opened in a web browser with Adobe Reader:

1. Open Adobe Acrobat Reader.
2. Open the Edit menu.
3. Choose the Preferences... option.
4. Choose the Internet section.
5. Uncheck the Display PDF in browser checkbox.
   Block the use of the Doc.media.newPlayer method

This specific vulnerability can be mitigated by blocking the use of the newPlayer() method through use of the Adobe Reader and Acrobat JavaScript Blacklist Framework. Windows users can obtain a ZIP file of .REG files that disable the newPlayer() method of the Doc.media object. Upon opening a PDF that attempts to use this method, Adobe Reader and Acrobat will warn the user that a JavaScript that the document uses is disabled for security reasons. Mac and Linux users should see the Blacklist Framework document for details about how to implement the workaround.

Vendor Information

508357

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Adobe __ Affected

Notified: December 15, 2009 Updated: January 13, 2010

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

This issue is addressed in Adobe Reader 9.3 and 8.2. Please see Adobe Security Bulletin APSB10-02 for details.

Vendor References

• <http://www.adobe.com/support/security/bulletins/apsb10-02.html&gt;
• <http://www.adobe.com/support/security/advisories/apsa09-07.html&gt;
• <http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html&gt;

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.adobe.com/support/security/advisories/apsa09-07.html&gt;
• <http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html&gt;
• <http://kb2.adobe.com/cps/532/cpsid_53237.html&gt;
• <http://osvdb.org/show/osvdb/60980&gt;
• <http://secunia.com/advisories/37690/&gt;
• <http://www.symantec.com/connect/blogs/zero-day-xmas-present&gt;
• <http://voices.washingtonpost.com/securityfix/2009/12/hackers_target_unpatched_adobe.html&gt;
• <http://vrt-sourcefire.blogspot.com/2009/12/this-is-what-happens-when-you-try-to-do.html&gt;

Acknowledgements

Thanks to Adobe PSIRT for reporting this vulnerability.

This document was written by Will Dormann.

Other Information

CVE IDs:	CVE-2009-4324
Severity Metric:	65.84 Date Public: