search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

CERT Coordination Center

Adobe Acrobat Plug-In cross domain violation

Vulnerability Note VU#815960

Original Release Date: 2007-01-03 | Last Revised: 2008-04-30

Overview

The Adobe Acrobat Plug-In fails to properly validate user-supplied content, which may allow for cross-site scripting.

Description

Adobe Acrobat Reader is software designed to view Portable Document Format (PDF) files. Adobe also distributes the Adobe Acrobat Plug-In to allow users to view PDF files inside of a web browser.

The Adobe Acrobat Plug-In PDF Open Parameters feature allows users to specify actions to take on a PDF document via URI parameters. However, the Adobe Acrobat Plug-In fails to properly validate these URI parameters for scripting code. This allows user-supplied scripts to execute within the context of the web site hosting the PDF file causing a cross-site scripting vulnerability. More information about cross-site scripting is available in CERT Advisory CA-2000-02.

Additionally, any PDF documnt can be leveraged to exploit this vulnerability, regardless of whether that document is on the local file system or a remote web server. However, web browsers typically prevent remote content from accessing resources on the local file system. This will stop scripts originating from remote sources from accessing resources on the local file system.

Impact

An attacker may be able to obtain sensitive data from a user that visits a web site hosting a PDF document. Depending on the nature of the web site, this data may include passwords, credit card numbers, and any arbitrary information provided by the user. Likewise, information stored in cookies could be stolen or corrupted.

Solution

Upgrade
This issue has been addressed in Adobe Reader 8. Adobe has issued updates for Adobe Reader versions prior to 8. See Adobe security bulletin APSB07-01 for more details. Users running operating systems that do not support Adobe Reader 8 should refer to the updates listed in Adobe Security Bulletin APSB07-01.


Until it is possible to upgrade to a fixed version of the Adobe Acrobat Plug-In, users can take the following steps to mitigate this vulnerability:

Disable the displaying of PDF documents in the web browser

Preventing PDF documents from opening inside a web browser may mitigate this vulnerability. If this workaround is applied to updated versions of the Adobe reader, it may mitigate future vulnerabilities.

To prevent PDF documents from automatically being opened in a web browser:

    1. Open Adobe Acrobat Reader.
    2. Open the Edit menu.
    3. Choose the preferences option.
    4. Choose the Internet section.
    5. Un-check the "Display PDF in browser" check box.

    Disable JavaScript

    For instructions on how to disable JavaScript, please refer to the Securing Your Web Browser document.
      Do not access PDF documents from untrusted sources

      Do not open unfamiliar or unexpected PDF documents, particularly those hosted on web sites or delivered as email attachments. Please see Cyber Security Tip ST04-010.
      Any website that hosts a PDF document may be leveraged to exploit this vulnerability. Web site and network Administrators can take the following steps to prevent their web sites from being leveraged in attacks using this vulnerability:

      Filter JavaScript in URLs

      Webserver administrators may be able to prevent their websites from being leveraged in attacks by deploying a reverse proxy that can filter JavaScript in URLs.

      Filter JavaScript leaving the network

      Network administrators may be able to prevent their clients being affected by this vulnerability by deploying a proxy server or firewall that can filter JavaScript in URLs.

      Vendor Information

      815960
       
      Expand all

      Adobe Affected

      Updated:  January 03, 2007

      Status

      Affected

      Vendor Statement

      We have not received a statement from the vendor.

      Vendor Information

      The vendor has not provided us with any further information regarding this vulnerability.


      CVSS Metrics

      Group Score Vector
      Base
      Temporal
      Environmental

      References

      Acknowledgements

      This vulnerability was discovered and reported by Stefano Di Paola, Giorgio Fedon, and Elia Florio.

      This document was written by Ryan Giobbi and Jeff Gennari.

      Other Information

      CVE IDs: CVE-2007-0045
      Severity Metric: 16.87
      Date Public: 2006-12-29
      Date First Published: 2007-01-03
      Date Last Updated: 2008-04-30 23:50 UTC
      Document Revision: 120

      Sponsored by CISA.

      Download PGP Key

      Read CERT/CC Blog

      Learn about Vulnerability Analysis