Re: [Full-disclosure] ZDI-11-072: Adobe Reader BMP ColorData Remote Code Execution Vulnerability

[root <root_@xxxxxxxxxxxxxxx>]

On 02/08/2011 06:40 PM, ZDI Disclosures wrote:
> ZDI-11-072: Adobe Reader BMP ColorData Remote Code Execution Vulnerability
> 
> http://www.zerodayinitiative.com/advisories/ZDI-11-072
> 
> February 8, 2011
> 
> -- CVE ID:
> CVE-2011-0599
> 
> -- CVSS:
> 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)
> 
> -- Affected Vendors:
> Adobe
> 
> -- Affected Products:
> Adobe Reader
> 
> -- TippingPoint(TM) IPS Customer Protection:
> TippingPoint IPS customers have been protected against this
> vulnerability by Digital Vaccine protection filter ID 10800. 
> For further product information on the TippingPoint IPS, visit:
> 
>     http://www.tippingpoint.com
> 
> -- Vulnerability Details:
> This vulnerability allows remote attackers to execute arbitrary code on
> vulnerable installations of Adobe Reader. User interaction is required
> to exploit this vulnerability in that the target must visit a malicious
> page or open a malicious file.
> 
> The flaw exists within the Bitmap parsing component of rt3d.dll. When
> allocating a destination buffer for handling 4/8-bit RLE compressed
> bitmaps, the process uses the bitmap bits per pixel and number of colors
> values directly. A pointer is created based on the specified color
> depth, which can then be used to copy user supplied data into the
> fixed-length color data buffer on the heap. A remote attacker can
> exploit this vulnerability to execute arbitrary code under the context
> of the user.
> 
> -- Vendor Response:
> Adobe has issued an update to correct this vulnerability. More
> details can be found at:
> 
> http://www.adobe.com/support/security/bulletins/apsb11-03.html
> 
> -- Disclosure Timeline:
> 2010-11-15 - Vulnerability reported to vendor
> 2011-02-08 - Coordinated public release of advisory
> 
> -- Credit:
> This vulnerability was discovered by:
>     * Peter Vreugdenhil ( http://vreugdenhilresearch.nl )
> 
> -- About the Zero Day Initiative (ZDI):
> Established by TippingPoint, The Zero Day Initiative (ZDI) represents 
> a best-of-breed model for rewarding security researchers for responsibly
> disclosing discovered vulnerabilities.
> 
> Researchers interested in getting paid for their security research
> through the ZDI can find more information and sign-up at:
> 
>     http://www.zerodayinitiative.com
> 
> The ZDI is unique in how the acquired vulnerability information is
> used. TippingPoint does not re-sell the vulnerability details or any
> exploit code. Instead, upon notifying the affected product vendor,
> TippingPoint provides its customers with zero day protection through
> its intrusion prevention technology. Explicit details regarding the
> specifics of the vulnerability are not exposed to any parties until
> an official vendor patch is publicly available. Furthermore, with the
> altruistic aim of helping to secure a broader user base, TippingPoint
> provides this vulnerability information confidentially to security
> vendors (including competitors) who have a vulnerability protection or
> mitigation product.
> 
> Our vulnerability disclosure policy is available online at:
> 
>     http://www.zerodayinitiative.com/advisories/disclosure_policy/
> 
> Follow the ZDI on Twitter:
> 
>     http://twitter.com/thezdi
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
> 

Haha code execution on *every* image format, how do you manage to do
that? it was some kind of requirement, I suppose.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/