Feeds

Researcher spies new Adobe code execution bug

Download Manager + web flaw = threat

  • alert
  • submit to reddit

Top 5 reasons to deploy VMware with Tegile

A researcher has unearthed a bug in software used to install Adobe's ubiquitous Reader and Flash applications that can be exploited to remotely install malicious files on end user PCs.

The Adobe Download Manager is an ActiveX script that is invoked when people install or update Reader or Flash using Internet Explorer. Researcher Aviv Raff has figured out how to exploit it to install any file he wishes simply by tricking a user into clicking on a link on the Adobe.com domain.

The attack combines a vulnerability on Adobe's website with a defect in the download manager. The result: he was able to install and execute his own instance of the Windows calculator on a Register test machine. Aviv demonstrated the exploit on the condition further technical details be withheld.

"Instead of admitting that this design flaw is indeed a problem which can be abused by malicious attackers, Adobe decided to downplay this issue," Raff wrote here in disclosing the vulnerability. He was referring to unpublished comments an Adobe spokeswoman made to Zero Day blogger Ryan Naraine.

In part, the comments said the download manager "is designed to remove itself from the computer after use at the next restart," "can only be used to download the latest version of software hosted on Adobe.com," and "presents a very large user dialog box when downloading software."

But because the download manager remains on a machine until it is rebooted, attackers have ample opportunity to exploit the bug. Assuming the typical machine is restarted once every 24 to 72 hours, attacks have a reasonable chance of success as long as they are launched within the first one to three days of a recent update. (We're guessing a fair percentage of people would be unfazed by the dialog box).

And once that happens, attackers have the ability to remotely install malicious code on an untold millions of PCs, as the following screenshots suggest.

Screenshot of Adobe Download Manager
Screenshot of Windows caculator installed

In an email to El Reg in response to Raff's post, Adobe spokeswoman Wiebke Lips wrote: "Adobe is aware of the recently posted report of a remote code execution vulnerability in the Adobe Download Manager. We are working with the researcher, Aviv Raff, and the third party vendor of this component to investigate and resolve the issue as quickly as possible."

Updates will be posted on Adobe's PSIRT blog, she added.

As we suggested recently, the myriad bugs that over the past few years have routinely imperiled the entire internet have made Adobe the Toyota of the software industry. Company security personnel seem intent of correcting the problems, but the only way for that to happen is to launch a comprehensive initiative that makes a top-to-bottom review of the company's entire code base.

Adobe Download Manager would be as good a place as any to start. ®

Remote control for virtualized desktops

More from The Register

next story
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Mozilla, EFF, Cisco back free-as-in-FREE-BEER SSL cert authority
Let’s Encrypt to give HTTPS-everywhere a boost in 2015
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
Got an iPhone or iPad? LOOK OUT for MASQUE-D INTRUDERS
UNjailbroken iOS 7, 8 open to evil, says secbiz FireEye
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.