Thursday, 19 February 2009
When PDFs Attack - Acrobat [Reader] 0-Day On the Loose
The Shadowserver Foundation has recently become aware of a very severe vulnerability in Adobe Acrobat affecting versions 8.x and 9 that is currently on the loose in the wild and being actively exploited. We are aware of several different variations of this attack, however, we were provided with a sample last week in which we were permitted to analyze and detail in this post. We want to make it clear that we did not discover this vulnerability and are only posting this information to make sure others are aware and can adequately protect themselves. All of our testing was done on Adobe Acrobat Reader 8.1.0, 8.1.1, 8.1.2, 8.1.3 (latest release of 8), and 9.0.0 (latest release of 9). We have not confirmed via testing that the exploit actually works on Adobe Acrobat (non-Reader) but believe that it will also affect it as well.
Right now we believe these files are only being used in a smaller set of targeted attacks. However, these types of attacks are frequently the most damaging and it is only a matter of time before this exploit ends up in every exploit pack on the Internet. As a result we are also not going to provide any specific details on how the exploit works despite the fact that information is known. We know several of the details on the internals thanks to a good friend of mine -- Matt Richard. He took a look at the file for us last week and provided the following:
Testing of the exploit with XP SP3 using Adobe Reader 8.1.1, 8.1.2, 8.1.3 and 9.0.0 shows that the vulnerability results in code execution on all of them. There may be cases where Adobe Reader crashes without code execution, especially on systems with more physical memory and faster processors. This is likely due to the race condition needed to populate the heap before certain data structures are parsed by Reader.
We believe Adobe is aware of this issue and actively working to address it. However, we felt it was necessary to release this information to let people know how to mitigate against the attacks as they can be devastating. Right now multiple Antivirus companies detect this threat. We will update this post as we have more information that we can share on this.
A special thanks to the kind source that provided the file to us last week for analysis.
We have also been informed Trend Micro currently detects this threat as "TROJ_PIDIEF.IN".
It has been pointed out to us that Symantec may have been protecting against this since February 12, 2009. We have not had it confirmed but believe they detect it as Trojan.Pidief.E which has a write-up here.
Adobe has since issued a public advisory about this issue that has been posted here. They are expecting an update by March 11th, 2009 for Adobe 9 and updates for other version (8 and 7) to follow soon after. We have also received some other feedback and information that may be useful that we will post in the near future.
=>Posted February 19, 2009, at 03:03 PM by Steven Adair