VUPEN Security Research - Adobe Acrobat & Reader XI-X Barcode Heap Overflow (Pwn2Own)

2014-05-29T00:00:00
ID SECURITYVULNS:DOC:30758
Type securityvulns
Reporter Securityvulns
Modified 2014-05-29T00:00:00

Description

VUPEN Security Research - Adobe Acrobat & Reader XI-X Barcode Heap Overflow (Pwn2Own)

Website : http://www.vupen.com

Twitter : http://twitter.com/vupen

I. BACKGROUND

Adobe Acrobat and Reader are the global standards for electronic document sharing. They are used to create, view, search, digitally sign, verify, print, and collaborate on Adobe PDF files.

II. DESCRIPTION

VUPEN Vulnerability Research Team discovered a critical vulnerability in Adobe Acrobat and Reader.

The vulnerability is caused by a heap overflow error when processing the "width" and "height" fields of a barcode element in a PDF, which could be exploited to execute arbitrary code via a malicious PDF file.

III. AFFECTED PRODUCTS

Adobe Acrobat and Reader XI version 11.0.06 and prior Adobe Acrobat and Reader XI version 10.1.9 and prior

IV. SOLUTION

Upgrade to Adobe Acrobat and Reader XI v11.0.07 or X v10.1.10.

V. CREDIT

This vulnerability was discovered by VUPEN Security.

VI. ABOUT VUPEN Security

VUPEN is the leading provider of defensive and offensive cyber security intelligence and advanced zero-day research. All VUPEN's vulnerability intelligence results exclusively from its internal and in-house R&D efforts conducted by its team of world-class researchers.

VUPEN Solutions: http://www.vupen.com/english/services/

VII. REFERENCES

http://helpx.adobe.com/security/products/reader/apsb14-15.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0511

VIII. DISCLOSURE TIMELINE

2013-07-31 - Vulnerability Discovered by VUPEN Security 2014-03-13 - Vulnerability Reported to Adobe During Pwn2Own 2014 2014-05-13 - Vulnerability Fixed by Adobe 2014-05-26 - Public disclosure