Adobe Reader 7: XML External Entity (XXE) Attack

[Sverre H. Huseby]

XML External Entity (XXE) Attack Possible in Adobe Reader 7
-----------------------------------------------------------

SHH #7, 2005-06-16

Description
-----------

Recent versions of Adobe Reader (previously known as Acrobat Reader)
are vulnerable to XML External Entity (XXE) Attacks. By including a
JavaScript in a PDF file, and have this JavaScript parse an embedded
XML document with a reference to an external entity, it is possible to
read certain types of textual files on the local computer, and have
them sent to a remote attacker.


Details
-------

The hairy details (the problem description sent to Adobe), including
sample PDFs, are available on a separate web page:
http://shh.thathost.com/secadv/adobexxe/


Solution
--------

Disable the use of JavaScript in Adobe Reader, or upgrade to a version
not vulnerable to this attack.


Vendor Notification
-------------------

The Adobe developers were notified on 2005-04-15. They made a fix
available on 2005-06-15.


Affected versions
-----------------

Confirmed to work in version 7.0 and 7.0.1 on Microsoft Windows,
version 7.0 on GNU/Linux and version 7.0 on Mac OSX.

It is unknown whether the attack works in version 6, which also
supports JavaScript in PDF files.


Fixed versions
--------------

Adobe Reader version 7.0.2.
For Adobe's own advisory, see the following URL:
http://www.adobe.com/support/techdocs/331710.html


Credits
-------

Thanks to Jeremiah Grossman for verifying that the attack also works
on the Mac OSX version of Adobe Reader.


----------------------------
Reported by Sverre H. Huseby

[Slawek]

Hello!
In message to <bugtraq@securityfocus.com> sent Thu, 16 Jun 2005 17:08:38
+0200 you wrote:

SHH> XML External Entity (XXE) Attack Possible in Adobe Reader 7
SHH> -----------------------------------------------------------

SHH> SHH #7, 2005-06-16

[...]

SHH> Fixed versions
SHH> --------------

SHH> Adobe Reader version 7.0.2.
SHH> For Adobe's own advisory, see the following URL:
SHH> http://www.adobe.com/support/techdocs/331710.html


It looks like Adobe Acrobat Reader 7 automatically downloads this update (if
enabled to do so), but unfortunatelly there is probably a problem with an
update itself.

My situation:
1) I've spotted a few PDF files which required Reader 7.
2) There were no Polish version of the Reader 7 available so I've installed
English one.
3) An update was automatically detected by the Reader and it installed
without problems.
4) I've noticed Polish version is available, so I've downloaded it.
5) I've uninstalled Reader 7 and the security update and installed Polish
version.
6) An update doesn't install now (although Reader detects it needs it).

I've tried reinstalling English version and it doesn't want to install an
update either.

So better don't uninstall the Reader after you've installed the update or
you'll may end up being not protected.

------------------------------------------
Slawomir Piotrowski / Telsat GP
Rejestracja Czasu Pracy i Kontrola Dostepu
http://www.ewidencja-czasu-pracy.pl
------------------------------------------