Adobe Acrobat and Adobe Reader are ubiquitous applications for viewing PDF (Portable Document Format) documents.

Since version 4.0, Acrobat includes JavaScript functionality allowing for customization and extensibility. Acrobat JavaScript is an extension of the core JavaScript which adds Acrobat-specific classes that enable the author to manage document related tasks. These classes include app, dbg, console, Doc, SOAP, ADBC, util, etc.

An annot object represents a particular Acrobat annotation created using the Acrobat annotation tool. Annotation types include: Text, FreeText, Line, Square, Circle, Polygon, PolyLine, Highlight, etc. The Doc object provides the getAnnots method, which returns an array of Annot Objects based on the parameters provided to it, or returns a Null value if no results are found. This method accepts four parameters:

getAnnots(nPage, nSortBy, bReverse, nFilterBy)

• nPage: A 0-based page number that specifies from which page to get Annots.

• nSortBy: A sort method applied to the array.

• bReverse: If true, causes the array to be reverse sorted.

• nFilterBy: Gets only those annotations that satisfy certain criteria.

There exists a buffer overflow vulnerability in Adobe Acrobat/Reader. Specifically, the vulnerability is due to improper parsing of the getAnnots JavaScript function. The code does not validate the parameters passed to the function. When all four parameters are passed as negative numbers, the program memory will be corrupted.

An attacker can exploit this vulnerability by enticing a user to open a crafted PDF document. Successful exploitation would allow for arbitrary code injection and execution with the privileges of the currently logged in user. Code injection that does not result in execution would terminate the application due to memory corruption.

The vulnerability has been assigned as CVE-2009-1492.

SonicWALL has released a IPS signature to detect and block specific exploitation attempts targeting this vulnerability. The signature is listed bellow:

• 5503 – Adobe Reader getAnnots Method Memory Corruption Attempt

Symantec Products Alert management System 2 (AMS2) is a package included by various Symantec Solutions such as System Centre, AntiVirus Server, and AntiVirus Central Quarantine Server. AMS2 contains a component named Intel Alert Originator (IAO) Service, which is run under System account by default.

IAO Service is using a proprietary protocol to exchange messages with other modules. One of the messages is called BIND message. It has the following format:

 Offset Size Description ----------- ---------- ----------------------------------------- 0000   8    filled with "0xFF" 0008   6    unknown, seems always contain 0x00 0x00 0x02 0x00 0x95 0x94 000E   4    IPv4 address of client 0012   8    filled with "0x00" 001A   4    message size covering header (N) 001E   19   unknown 0031   1    Bind Type (Save=0x02 Remove=0x03) 0032   8    unknown 003A   4    Bind Identifier ("BIND") 003E   17   unknown 004F   5    Bind Identifier2 ("BINDx00") 0054   N    Bind Parameters (N-84) 

There is a stack-based buffer overflow vulnerability in IAO Service of AMS2. The vulnerability is due to a boundary error in the IAO service when processing crafted “Bind Remove” messages. Specifically, the vulnerable code copies message parameters into a stack-based buffer without verifying the size of the “Bind Remove” message. Thus, an overly long string can overwrite critical stack data including function return addresses and SEH handler structure. By exploiting this vulnerability, an attacker can successfully inject and execute arbitrary code within the security context of the service, which is System by default.

SonicWALL has released an IPS signature that will detect and block a generic attack attempt addressing this issue. The following IPS signature has been released today:

• 1440 Symantec Alert Management System BO Attempt

This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2009-1430.

The Oracle Application Server is a multi-platform application development and deployment system. With every installation of the Application Server comes the Oracle Process Manager and Notification Server (OPMN), which, among other tasks, manages the starting, stopping and monitoring of all applications. The OPMN is an essential part of the Application Server.

The OPMN consists of three components, the Oracle Notification Server, Oracle Process Manager, and Process Manager Modules. Oracle Notification Server (ONS) is the transport mechanism for failure, recovery, startup, and other related notifications between components in Oracle Application Server. Oracle Process Manager (PM) is used to manage Oracle Application Server processes. Finally, the Oracle Process Manager Modules (PM Modules) implement Oracle Application Server component-specific process management functionality.

A format string vulnerability exists in the Oracle Application Server OPMN service. The specific vulnerability is due to insufficient validation of the URI part of incoming HTTP requests.
The vulnerable code directly uses the received URI string in a fprintf function call, without any prior sanitization. The said function is used to print the URI string to a local log file. However, if the URI string contains format specifiers such as “%s”, “%x”, or “%n” then the fprintf function will interpret them as such. In such cases, the execution of fprintf may result in arbitrary data being written to critical memory locations, thereby overwriting process critical data.

A carefully crafted URI string that is intended to exploit this flaw may result in process flow diversion which may consequently result in a system wide compromise.

SonicWALL has released an IPS signature that will detect and prevent generic attacks targeting this vulnerability. The following signature was created:

• 1436 – Oracle Application Server OPMN Service Format String Attack

This vulnerability has been assigned the CVE identifier CVE-2009-0993.

The Microsoft PowerPoint presentation application is capable of creating and playing complex presentations utilizing audio visual components. Files created by the application are typically assigned the file extension ppt. PowerPoint presentation files use the proprietary Compound Document Object format. Application specific data in this format is contained in data streams. The streams containing PowerPoint presentation data are comprised of a series of records that start with a generic header. The structure of this header is shown:

 Offset Size     Field ------ -------- ---------------- 0x0000 uint16   RecVersion 0x0002 uint16   RecType 0x0004 uint32   RecLength, n 0x0008 char[n]  Data

There are two categories of records, the Atom record and the Container record. The Atom record contains information about objects stored inside containers. The Container record stores atoms and other containers.

A memory corruption vulnerability has been identified in the PowerPoint application. Namely, the processing of two Atom records, the TextHeaderAtom (RecType=0xf9f) and OutlineTextRefAtom (RecType=0xf9a) records is flawed. When handling these two Atoms contained in the same container, the vulnerable code will attempt to free a block of allocated memory twice. This will result in corruption of memory which will consequently result in either the termination of the application or diversion of the process flow. It is conceivable that, with a carefully crafted malicious ppt document, the vulnerability can be exploited for code injection and execution. Successful code injection exploitation of this flaw is not a trivial task.

SonicWALL has released an IPS signature that will detect and block a specific exploit attempt. Detection of generic exploitation attempts of this flaw is not feasible as that would require a full PowerPoint presentation parser. The following IPS signature has been released to address this vulnerability:

• 5460 – MS PowerPoint Invalid Object Reference Code Execution PoC

This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2009-0556.