PDF exploit built to combine zero-day Windows and Adobe Reader bugs

guest · May 16, 2018

PDF exploit built to combine zero-day Windows and Adobe Reader bugs
May 15, 2018
https://www.scmagazine.com/pdf-expl...windows-and-adobe-reader-bugs/article/766100/

In a blog post describing the dual exploit, Anton Cherepanov, an ESET senior malware researcher, states the malicious PDF sample was found uploaded to a public repository, but did not yet contain a final payload, meaning it may have been spotted while still under early-stage development.

When opened, the PDF sample first embeds JavaScript code in Adobe Reader to exploit the critical double free memory corruption vulnerability CVE-2018-4990 -- one of 47 Acrobat and Reader bugs that Adobe repaired via security updates on May 14. The exploit enables attackers to read and write in memory, allowing them to execute shellcode that executes a malicious PE file.

But for this RCE exploit to be truly devastating, the attackers next have to bypass the Abode Reader protective sandbox and compromise the entire computer -- and that's where the Windows OS bug comes into play. The elevation of privilege vulnerability, CVE-2018-8120, occurs in the Win32k component when it fails to properly handle objects in memory, and can be exploited to run arbitrary code in kernel mode, giving attackers total control.
Cherepanov is credited with finding the Microsoft issue and was given co-credit along with Microsoft researcher Matt Oh for reporting the Adobe vulnerability.
Click to expand...

Log in or Sign up

PDF exploit built to combine zero-day Windows and Adobe Reader bugs

guest Guest

Log in or Sign up

PDF exploit built to combine zero-day Windows and Adobe Reader bugs

guest Guest

Useful Searches