Adobe/Acrobat 0-day

[WIEx]

Serg, thx, good work:)

[Serg]

Serg, thx, good work:)

Ur welcome)
WIEx r u from opensc.ws?  and r ur icq 274734*?

[WIEx]

WIEx r u from opensc.ws?

No, Only as a spectator)

and r ur icq 274734*?

no:)

[SysAdMini]

Adobe Acrobat pdf 0-day exploit, No JavaScript needed
https://isc.sans.org/diary.html?storyid=5926

http://secunia.com/blog/44/

[Serg]

tested on malware

payload doesn't start but reader crached => exp works, no js needed... shit...

[Serg]

Adobe Reader and Acrobat Issue update
http://blogs.adobe.com/psirt/

Adobe is also planning to make updates available for Adobe Reader 7 and 8, and Acrobat 7 and 8, by March 18th.

1. Launch Acrobat or Adobe Reader.
2. Select Edit>Preferences
3. Select the JavaScript Category
4. Uncheck the ‘Enable Acrobat JavaScript’ option
5. Click OK

I hate adobe. 1 month without solution...

[WIEx]

upload this file here

[dash_neghab]

Could we have this file for analysis also? At least entire javascript code....

[Serg]

Could we have this file for analysis also? At least entire javascript code....

No

[SysAdMini]

Didier Stevens decribes a howto get infected from this pdf vulnerability WITHOUT opening the pdf file !!!!

Quickpost: /JBIG2Decode Trigger Trio
http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/

[kenrry]

Could we have this file for analysis also? At least entire javascript code....

No

maybe,the javascript code its not important ,javascript only make a heap spray with a address,but  from the info on the net, cant find the exploit address,so the head of jbig2decode stream i think is very important
also ,in windows,if the mouse jump to the PDF file ,the acroRD32info.exe will open it without using reader,
add me with icq 94507815 and get more info

[dash_neghab]

Thanks for PoC :-) 

[DiFor]

tell me plz, how can I insert it in a way exploit JS source, or Shellcode (execute for example)?

[dash_neghab]

Ask Serg about it

[sowhat-x]

He-he,I really hate "replying in place" of others,but well...I think Serg already gave his answer regarding this issue...