Zero day PDF exploit for Adobe Acrobat


Link to exploit:

http://security.fedora-hosting.com/0day/pdf/pdf_poc.pdf

Please download and open it _locally_ in Adobe Acrobat (not in Adobe Acrobat ActiveX control
because of some internal restrictions within Adobe ActiveX, it may be bypassed via:
http://seclists.org/bugtraq/2007/Oct/0213.html but i didn't made tests).

Also make sure that "mailto" handler is set to Internet Explorer 7 (any 3rd party mail
clients is not installed).


Description:

0-day proof of concept (PoC) exploit for Adobe Acrobat.

Tested on WinXP SP2 Eng updated + Internet Explorer 7 + Adobe Acrobat Reader 8.1


Software affected:

+ Adobe Reader 8.1 (and earlier)
+ Adobe Acrobat Standard, Pro and Elements 8.1 (and earlier)
+ Adobe Acrobat 3D


System affected:

+ Windows XP with IE7


Details:

To view exploit code in Adobe Acrobat go to: Pages -> Page Properties -> Actions
(trigger: Page Open, action: Open a web link)

This is URL handling bug in shell32!ShellExecute()


Workaround:

Currently unavailable.

Temporary workaround: http://www.adobe.com/support/security/advisories/apsa07-04.html


Thanks to:

pdp (at) gnucitizen.org for his investigation


regards,
cyanid-E <biz4rre@gmail.com>