__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Adobe Acrobat Reader Uuencoding Buffer Overflow [Red Hat Advisory RHSA-2004:432-08] August 26, 2004 19:00 GMT Number O-205 ______________________________________________________________________________ PROBLEM: Adobe Acrobat Reader versions 5.05 and 5.06 for UNIX/Linux contain security vulnerabilities related to its uuencoding feature. See also CIAC C-Note-04-012. PLATFORM: Red Hat Desktop (v.3) Red Hat Enterprise Linux AS, ES, WS (v.3) SOFTWARE: Adobe Acrobat Reader 5.05 and 5.06 DAMAGE: An attacker could execute arbitrary code on a victim's machine if a user opens a specially crafted uuencoded document. Also, an attacker could create a file with a specially crafted file name which could lead to arbitrary command execution on a victim's machine. SOLUTION: Apply the available security updates. ______________________________________________________________________________ VULNERABILITY The risk is MEDIUM. An attacker may execute arbitrary code by ASSESSMENT: coercing a user to open a specially crafted file. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/o-205.shtml ORIGINAL BULLETIN: Red Hat Advisory 2004:432-08 https://rhn.redhat.com/errata/RHSA-2004-432.html ADDITIONAL LINKS: CIAC C-Note 04-012 iDEFENSE http://www.idefense.com/application/poi/display?id=124 &type=vulnerabilities http://www.idefense.com/application/poi/display?id=125 &type=vulnerabilities Security Tracker http://securitytracker.com/alerts/2004/Aug/1010941.html CVE/CAN: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= CAN-2004-0630 CAN-2004-0631 ______________________________________________________________________________ [***** Start Red Hat Advisory RHSA-2004:432-08 *****] Updated acrobat package fixes security issues Advisory: RHSA-2004:432-08 Last updated on: 2004-08-26 Affected Products: Red Hat Desktop (v. 3) Red Hat Enterprise Linux AS (v. 3) Red Hat Enterprise Linux ES (v. 3) Red Hat Enterprise Linux WS (v. 3) CVEs (cve.mitre.org): CAN-2004-0630 CAN-2004-0631 Security Advisory Security Advisory Details: An updated Adobe Acrobat Reader package that fixes multiple security issues is now available. The Adobe Acrobat Reader browser allows for the viewing, distributing, and printing of documents in portable document format (PDF). iDEFENSE has reported that Adobe Acrobat Reader 5.0 contains a buffer overflow when decoding uuencoded documents. An attacker could execute arbitrary code on a victim's machine if a user opens a specially crafted uuencoded document. This issue poses the threat of remote execution, since Acrobat Reader may be the default handler for PDF files. The Common Vulnerabilities and Exposures project has assigned the name CAN-2004-0631 to this issue. iDEFENSE also reported that Adobe Acrobat Reader 5.0 contains an input validation error in its uuencoding feature. An attacker could create a file with a specially crafted file name which could lead to arbitrary command execution on a victim's machine. The Common Vulnerabilities and Exposures project has assigned the name CAN-2004-0630 to this issue. All users of Acrobat Reader are advised to upgrade to this updated package, which is not vulnerable to these issues. Updated packages: Red Hat Desktop (v. 3) SRPMS: acroread-5.09-1.src.rpm 55bbb0328022f2eed2cb572bd5e264de i386: acroread-5.09-1.i386.rpm ab70943b0e7d266df504c7b66b5e5c26 acroread-plugin-5.09-1.i386.rpm a2bfb5fde963cc51804a18ea659a16e5 Red Hat Enterprise Linux AS (v. 3) SRPMS: acroread-5.09-1.src.rpm 55bbb0328022f2eed2cb572bd5e264de i386: acroread-5.09-1.i386.rpm ab70943b0e7d266df504c7b66b5e5c26 acroread-plugin-5.09-1.i386.rpm a2bfb5fde963cc51804a18ea659a16e5 Red Hat Enterprise Linux ES (v. 3) SRPMS: acroread-5.09-1.src.rpm 55bbb0328022f2eed2cb572bd5e264de i386: acroread-5.09-1.i386.rpm ab70943b0e7d266df504c7b66b5e5c26 acroread-plugin-5.09-1.i386.rpm a2bfb5fde963cc51804a18ea659a16e5 Red Hat Enterprise Linux WS (v. 3) SRPMS: acroread-5.09-1.src.rpm 55bbb0328022f2eed2cb572bd5e264de i386: acroread-5.09-1.i386.rpm ab70943b0e7d266df504c7b66b5e5c26 acroread-plugin-5.09-1.i386.rpm a2bfb5fde963cc51804a18ea659a16e5 (The unlinked packages above are only available from the Red Hat Network) Solution Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0630 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0631 http://www.idefense.com/application/poi/display?id=125&type=vulnerabilities http://www.idefense.com/application/poi/display?id=124&type=vulnerabilities [***** End Red Hat Advisory RHSA-2004:432-08 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Red Hat for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) O-196: "glibc" Buffer Overflow Vulnerabilities O-197: Microsoft Exchange Server 5.5 Outlook Web Access Vulnerability O-198: Rsync Unsanitised Input Processing CIACTech04-002: Rootkit Backdoor Trigger Detection Strings O-199: Cisco IOS Malformed OSPF Packet Causes Reload O-200: Updated PAM Packages O-201: Qt Package Vulnerabilities O-202: Buffer Overflow in the CDE Mailer dtmail(1X) O-203: Cisco Secure Access Control Server Vulnerabilities O-204: Netscape NSS Library Suite Remote Buffer Overflow