Adobe Reader U3D CLODMeshDeclaration Shading Count Buffer Overflow TSL ID: FSC20100413-01 1. Affected Software Adobe Systems Acrobat Reader 8.1.6 for Linux Adobe Systems Acrobat Reader 9.2 for Linux Adobe Systems Acrobat Reader 9.3 for Linux Reference: http://get.adobe.com/reader/ 2. Vulnerability Summary A remotely exploitable vulnerability has been discovered in Adobe Acrobat Reader for Linux. Specifically, the vulnerability is due to an integer overflow when processing the "Shading Count" field in the CLOD Mesh Declaration block, which may lead to a heap based buffer overflow and execution of arbitrary code. 3. Vulnerability Analysis This vulnerability may be exploited by remote attackers to execute arbitrary code on the vulnerable system by enticing a user to open a maliciously crafted PDF document. A successful attack will result in arbitrary code executed on the target host with the privileges of the logged-on user. An unsuccessful attack can abnormally terminate the affected product. 4. Vulnerability Detection TELUS Security Labs has confirmed the vulnerability in: Adobe Systems Acrobat Reader 8.1.6 for Linux Adobe Systems Acrobat Reader 9.2 for Linux Adobe Systems Acrobat Reader 9.3 for Linux 5. Workaround Avoid opening untrusted PDF files, or use an alternative application to process PDF files. 6. Vendor Response The vendor, Adobe, has released an advisory regarding this vulnerability: http://www.adobe.com/support/security/bulletins/apsb10-09.html 7. Disclosure Timeline 2010-02-19 Reported to vendor 2010-02-19 Initial vendor response 2010-04-13 Coordinated public disclosure 8. Credits Vulnerability Research Team, TELUS Security Labs 9. References CVE: CVE-2010-0196 TSL: FSC20100413-01 Vendor: apsb10-09 10. About TELUS Security Labs TELUS Security Labs, formerly Assurent Secure Technologies, is the leading provider of security research. Our research services include: * Vulnerability Research * Malware Research * Signature Development * Shellcode Exploit Development * Application Protocols * Product Security Testing * Security Content Development (parsers, reports, alerts) TELUS Security Labs provides a specialized portfolio of services to assist security product vendors with newly discovered commercial product vulnerabilities and malware attacks. Many of our services are provided on a subscription basis to reduce research costs for our customers. Over 50 of the world's leading security product vendors rely on TELUS Security Labs research. http://telussecuritylabs.com/