Executive brief
Adobe Acrobat and Reader are widely used applications for viewing and managing PDF documents. A vulnerability in how these programs process JPEG images could allow an attacker to take control of a user's computer if the user opens a specially crafted PDF file. This could lead to the theft of sensitive data, unauthorized software installation, or a complete system compromise.
Technical details
A heap-based buffer overflow vulnerability exists in the JPEG decoder routine of Adobe Acrobat and Reader. The flaw is rooted in the use of uninitialized memory (CWE-457) during the decoding of JPEG image data embedded within a PDF. Specifically, two uninitialized 4-byte integer values are used to determine loop boundaries and buffer offsets during a 'memcpy' operation. An attacker can exploit this by providing a specially crafted PDF file that, when parsed, causes the application to write data beyond the allocated heap buffer. Successful exploitation requires a user to open the malicious file and can result in arbitrary code execution in the context of the current user. Adobe has released patches (APSB17-01) to address this issue.
Affected products
- Adobe Acrobat DC 15.020.20042 and earlier (Continuous)
- Adobe Acrobat Reader DC 15.020.20042 and earlier (Continuous)
- Adobe Acrobat DC 15.006.30244 and earlier (Classic)
- Adobe Acrobat Reader DC 15.006.30244 and earlier (Classic)
- Adobe Acrobat 11.0.18 and earlier
- Adobe Reader 11.0.18 and earlier
Timeline
- 2017-01-20: advisory: Cisco Talos published technical report TALOS-2016-0259
- 2017-01-24: disclosed: Initial NVD publication and Adobe security bulletin APSB17-01 released
- 2017-01-24: patched: Adobe released security updates for Acrobat and Reader