Feeds

Researcher spies new Adobe code execution bug

Download Manager + web flaw = threat

  • alert
  • submit to reddit

The Power of One eBook: Top reasons to choose HP BladeSystem

A researcher has unearthed a bug in software used to install Adobe's ubiquitous Reader and Flash applications that can be exploited to remotely install malicious files on end user PCs.

The Adobe Download Manager is an ActiveX script that is invoked when people install or update Reader or Flash using Internet Explorer. Researcher Aviv Raff has figured out how to exploit it to install any file he wishes simply by tricking a user into clicking on a link on the Adobe.com domain.

The attack combines a vulnerability on Adobe's website with a defect in the download manager. The result: he was able to install and execute his own instance of the Windows calculator on a Register test machine. Aviv demonstrated the exploit on the condition further technical details be withheld.

"Instead of admitting that this design flaw is indeed a problem which can be abused by malicious attackers, Adobe decided to downplay this issue," Raff wrote here in disclosing the vulnerability. He was referring to unpublished comments an Adobe spokeswoman made to Zero Day blogger Ryan Naraine.

In part, the comments said the download manager "is designed to remove itself from the computer after use at the next restart," "can only be used to download the latest version of software hosted on Adobe.com," and "presents a very large user dialog box when downloading software."

But because the download manager remains on a machine until it is rebooted, attackers have ample opportunity to exploit the bug. Assuming the typical machine is restarted once every 24 to 72 hours, attacks have a reasonable chance of success as long as they are launched within the first one to three days of a recent update. (We're guessing a fair percentage of people would be unfazed by the dialog box).

And once that happens, attackers have the ability to remotely install malicious code on an untold millions of PCs, as the following screenshots suggest.

Screenshot of Adobe Download Manager
Screenshot of Windows caculator installed

In an email to El Reg in response to Raff's post, Adobe spokeswoman Wiebke Lips wrote: "Adobe is aware of the recently posted report of a remote code execution vulnerability in the Adobe Download Manager. We are working with the researcher, Aviv Raff, and the third party vendor of this component to investigate and resolve the issue as quickly as possible."

Updates will be posted on Adobe's PSIRT blog, she added.

As we suggested recently, the myriad bugs that over the past few years have routinely imperiled the entire internet have made Adobe the Toyota of the software industry. Company security personnel seem intent of correcting the problems, but the only way for that to happen is to launch a comprehensive initiative that makes a top-to-bottom review of the company's entire code base.

Adobe Download Manager would be as good a place as any to start. ®

Designing a Defense for Mobile Applications

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.