CVE-2013-0607 - Improper Control of Generation of Code ('Code Injection')

Severity

99%

Complexity

99%

Confidentiality

165%

Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0608, CVE-2013-0611, CVE-2013-0614, and CVE-2013-0618.

Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0608, CVE-2013-0611, CVE-2013-0614, and CVE-2013-0618.

CVSS 2.0 Base Score 9.9. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C).

Demo Examples

Improper Control of Generation of Code ('Code Injection')

CWE-94

This example attempts to write user messages to a message file and allow users to view them.


               
}
echo "Message Saved!<p>\n";
include($MessageFile);

While the programmer intends for the MessageFile to only include data, an attacker can provide a message such as:


               
message=%3C?php%20system(%22/bin/ls%20-l%22);?%3E

which will decode to the following:


               
<?php system("/bin/ls -l");?>

The programmer thought they were just including the contents of a regular data file, but PHP parsed it and executed the code. Now, this code is executed any time people view messages.

Notice that XSS (CWE-79) is also possible in this situation.

Improper Control of Generation of Code ('Code Injection')

CWE-94

edit-config.pl: This CGI script is used to modify settings in a configuration file.


               
}

                     

                           # code to add a field/key to a file goes here

                     

                           # code to set key to a particular file goes here

                     

                           # code to delete key from a particular file goes here

                     
eval($code);# this is super-efficient code, especially if you have to invoke# any one of dozens of different functions!
handleConfigAction($configfile, param('action'));
print "No action specified!\n";

The script intends to take the 'action' parameter and invoke one of a variety of functions based on the value of that parameter - config_file_add_key(), config_file_set_key(), or config_file_delete_key(). It could set up a conditional to invoke each function separately, but eval() is a powerful way of doing the same thing in fewer lines of code, especially when a large number of functions or variables are involved. Unfortunately, in this case, the attacker can provide other values in the action parameter, such as: add_key(",","); system("/bin/ls"); This would produce the following string in handleConfigAction(): config_file_add_key(",","); system("/bin/ls"); Any arbitrary Perl code could be added after the attacker has "closed off" the construction of the original function call, in order to prevent parsing errors from causing the malicious eval() to fail before the attacker's payload is activated. This particular manipulation would fail after the system() call, because the "_key(\$fname, \$key, \$val)" portion of the string would cause an error, but this is irrelevant to the attack because the payload has already been activated.

Overview

First reported 12 years ago

2013-01-10 11:56:00

Last updated 7 years ago

2017-09-19 01:35:00

Affected Software

Adobe Acrobat 9.0

9.0

Adobe Acrobat 9.0 Professional

9.0

Adobe Acrobat 9.1

9.1

Adobe Acrobat 9.1 Professional

9.1

Adobe Acrobat 9.1.1

9.1.1

Adobe Acrobat 9.1.1

9.1.1

アドビシステムズ アクロバット 9.1.2

9.1.2

アドビシステムズ アクロバット 9.1.3

9.1.3

Adobe Acrobat 9.1.3

9.1.3

Adobe Acrobat 9.2

9.2

Adobe Acrobat 9.2

9.2

Adobe Acrobat 9.3

9.3

Adobe Acrobat 9.3 Professional

9.3

Adobe Acrobat 9.3.1

9.3.1

Adobe Acrobat 9.3.1

9.3.1

Adobe Acrobat 9.3.2

9.3.2

Adobe Acrobat 9.3.2

9.3.2

Adobe Acrobat 9.3.3

9.3.3

Adobe Acrobat 9.3.4

9.3.4

Adobe Acrobat 9.3.4

9.3.4

Adobe Acrobat 9.4

9.4

Adobe Acrobat 9.4.1

9.4.1

Adobe Acrobat 9.4.1

9.4.1

Adobe Acrobat 9.4.2

9.4.2

Adobe Acrobat 9.4.2

9.4.2

Adobe Acrobat 9.4.3

9.4.3

Adobe Acrobat 9.4.3

9.4.3

Adobe Acrobat 9.4.4

9.4.4

Adobe Acrobat 9.4.4

9.4.4

Adobe Acrobat 9.4.5

9.4.5

Adobe Acrobat 9.4.5

9.4.5

Adobe Acrobat 9.4.6

9.4.6

Adobe Acrobat 9.4.6

9.4.6

Adobe Acrobat 9.4.7

9.4.7

Adobe Acrobat 9.5

9.5

Adobe Acrobat 9.5.1

9.5.1

Adobe Acrobat 9.5.2

9.5.2

Adobe Acrobat Reader 9.0

9.0

Adobe Acrobat Reader 9.1

9.1

Adobe Acrobat Reader 9.1.1

9.1.1

Adobe Acrobat Reader 9.1.2

9.1.2

Adobe Acrobat Reader 9.1.3

9.1.3

Adobe Acrobat Reader 9.2

9.2

Adobe Acrobat Reader 9.3

9.3

Adobe Acrobat Reader 9.3.1

9.3.1

Adobe Acrobat Reader 9.3.2

9.3.2

Adobe Acrobat Reader 9.3.3

9.3.3

Adobe Acrobat Reader 9.3.4

9.3.4

Adobe Acrobat Reader 9.4

9.4

Adobe Acrobat Reader 9.4.1

9.4.1

Adobe Acrobat Reader 9.4.2

9.4.2

Adobe Acrobat Reader 9.4.3

9.4.3

Adobe Acrobat Reader 9.4.4

9.4.4

Adobe Acrobat Reader 9.4.5

9.4.5

Adobe Acrobat Reader 9.4.6

9.4.6

Adobe Acrobat Reader 9.4.7

9.4.7

Adobe Acrobat Reader 9.5

9.5

Adobe Acrobat Reader 9.5.1

9.5.1

Adobe Acrobat Reader 9.5.2

9.5.2

Adobe Acrobat X (10.0)

10.0

Adobe Acrobat X Professional

10.0

Adobe Acrobat X (10.0.1)

10.0.1

Adobe Acrobat 10.0.1 Professional

10.0.1

Adobe Acrobat X (10.0.2)

10.0.2

Adobe Acrobat X (10.0.3)

10.0.3

Adobe Acrobat X (10.1)

10.1

Adobe Acrobat X (10.1.1)

10.1.1

Adobe Acrobat X (10.1.2)

10.1.2

Adobe Acrobat X (10.1.3)

10.1.3

Adobe Acrobat X (10.1.4)

10.1.4

Adobe Acrobat Reader X (10.0)

10.0

Adobe Acrobat Reader X (10.0.1)

10.0.1

Adobe Acrobat Reader X (10.0.2)

10.0.2

Adobe Acrobat Reader X (10.0.3)

10.0.3

Adobe Acrobat Reader X 10.1

10.1

Adobe Acrobat Reader X 10.1.1

10.1.1

Adobe Acrobat Reader X (10.1.2)

10.1.2

Adobe Acrobat Reader X (10.1.3)

10.1.3

Adobe Acrobat Reader X (10.1.4)

10.1.4

Adobe Acrobat 11.0

11.0

Adobe Acrobat Reader 11.0

11.0

References

SUSE-SU-2013:0044

SUSE-SU-2013:0047

openSUSE-SU-2013:0138

openSUSE-SU-2013:0193

RHSA-2013:0150

GLSA-201308-03

http://www.adobe.com/support/security/bulletins/apsb13-02.html

Vendor Advisory

oval:org.mitre.oval:def:15499

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.