Based on information from the PSIRT, both vulnerabilities will impact all versions of Adobe Reader from 9.x to 11.x. (Some Acrobat versions are also vulnerable.) We verified this claim and found the sample affected all of them.<\/p>\n
The exploit is spread by a malicious PDF file. When Reader opens the PDF file, it will trigger the vulnerability and start the exploit. This PDF file delivers a very complex attack, bypassing the current Adobe sandbox mechanism to launch the malware.<\/p>\n This flow shows the basic steps for the attack path:<\/p>\n The files D.T and L2P.T are DLLs in a sandboxed temp path, as in the following:<\/p>\n A new PDF is created in the normal temp path:<\/p>\n The new PDF, Visaform Turkey, will appear to hide the exploitation. The exploit uses a lot of memory in the background.<\/p>\n <\/p>\n The PDF\u2019s first exploit uses a heap overflow to overwrite a virtual function pointer, and also uses a memory information leak to bypass the address space layout randomization (ASLR) protection in Windows. Return-oriented programming is used to bypass data execution prevention (DEP).<\/p>\n Let\u2019s sidetrack for a moment and look at two definitions: Return-oriented programming<\/i><\/b>\u00a0(ROP) is an exploit\u00a0technique in which an attacker controls the\u00a0call stack\u00a0to indirectly execute arbitrary intended or unintended code to deliver an attack, thereby bypassing security features such as DEP. Stack pivoting<\/i><\/b> is a common technique used by ROP-based exploits. Pointing the stack pointer to an attacker-owned buffer, such as the heap, will provide more flexibility for the attacker to carry out a complex ROP exploit.<\/p>\n Here\u2019s how the exploit works from the first trigger point. The vulnerability is in AcroForm.api. After the exploit prepares customized stack data on the heap, the data triggers the exploit via following instructions in AcroForm.api.<\/p>\n With a modified virtual function pointer, the instruction calls into a special ROP gadget, which will start pivoting.<\/p>\n The address for the first gadget is 0x209b9f50. Here\u2019s the original code:<\/p>\n But if we decode from 0x209b9f50, the code piece looks like what follows. This is the ROP gadget for stack pivoting:<\/p>\n Now the stack points to a fake stack in the heap. The code log in a debugger at runtime looks like this:<\/p>\n Once the customized stack works, it will start more ROP gadgets. When the next Ret instruction is called, the stack looks like this:<\/p>\n What\u2019s the instruction for 0x6acc1049? It is offset 0x1049 from AcroForm.api because 0x6acc00 is the base address for the target module. Here is the unintended ROP gadget again:<\/p>\n The decoded ROP gadget is just a Ret instruction:<\/p>\n It will repeat from stack 0x11849a34 to stack 0x1184beb4, a whopping 9,344 (0x2480) times!<\/p>\n Let\u2019s see what the stack content is now:<\/p>\n The next gadget will move the esp register to esi. It will control the stack itself.<\/p>\n The gadget still includes lots of return addresses with repeated patterns, such as these:<\/p>\n With related code pieces:<\/p>\n So the logic will write target memory with values in the ecx register. The same pattern will repeat many times to modify 0x6b55e001, which is the beginning of the data section of AcroForm.api.<\/p>\n The data from 0x6b55e001 to 0x6b55e04e is modified and writes several API\/DLL names into the area of 0x6b55e001:<\/p>\n These strings are later used as parameters, during ROP-based API calls. After writing these strings into the data section, the ROP code continues with the following gadgets:<\/p>\n We can list the first piece of an ROP gadget step by step. The following code moves [esp] to ecx:<\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6b218551<\/strong><\/p>\n 1184c074\u00a0 cccc0240 6b022c74 6b19567b 6ad6ed72<\/strong><\/p>\n 1184c084\u00a0 6b19567b 6b237664<\/strong><\/p>\n <\/p>\n 6b218551 58\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 pop\u00a0\u00a0\u00a0\u00a0 eax<\/p>\n 6b218552 c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6b022c74 0fb7c0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 movzx\u00a0\u00a0 eax,ax<\/p>\n 6b022c77 c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6b19567b 97\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 xchg\u00a0\u00a0\u00a0 eax,edi<\/p>\n 6b19567c c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6ad6ed72 01f7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 add\u00a0\u00a0\u00a0\u00a0 edi,esi<\/p>\n 6ad6ed74 c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6b19567b 97\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 xchg\u00a0\u00a0\u00a0 eax,edi<\/p>\n 6b19567c c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6b237664 91\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 xchg\u00a0\u00a0\u00a0 eax,ecx<\/p>\n 6b237665 c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n The following code moves the pointer to eax, and then writes [eax] with the previous value in ecx:<\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6b218551 cccc023c<\/strong><\/p>\n 1184c094\u00a0 6b022c74 6b19567b 6ad6ed72 6b1d943b<\/strong><\/p>\n 1184c0a4\u00a0 6b16d51a<\/strong><\/p>\n <\/p>\n 6b218551 58\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 pop\u00a0\u00a0\u00a0\u00a0 eax<\/p>\n 6b218552 c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6b022c74 0fb7c0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 movzx\u00a0\u00a0 eax,ax<\/p>\n 6b022c77 c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6b19567b 97\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 xchg\u00a0\u00a0\u00a0 eax,edi<\/p>\n 6b19567c c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6ad6ed72 01f7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 add\u00a0\u00a0\u00a0\u00a0 edi,esi<\/p>\n 6ad6ed74 c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6b1d943b 57\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 push\u00a0\u00a0\u00a0 edi<\/p>\n 6b1d943c 58\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 pop\u00a0\u00a0\u00a0\u00a0 eax<\/p>\n 6b1d943d c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6b16d51a 8908\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0mov\u00a0\u00a0\u00a0\u00a0 dword ptr [eax],ecx<\/p>\n 6b16d51c c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n The following code gets the LoadLibraryA() API pointer from the import table:<\/p>\n 1184c0a4\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6b218551 6b32b234 6b1d92ac<\/strong><\/p>\n 6b218551 58\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 pop\u00a0\u00a0\u00a0\u00a0 eax<\/p>\n 6b218552 c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n 6b1d92ac ff10\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 call\u00a0\u00a0\u00a0 dword ptr [eax]<\/p>\n 6b1d92ae c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n At this point, the stack keeps the parameter for LoadLibraryA(). This is actually a string for MSVCR100.dll in the \u201cidata\u201d section.<\/p>\n Once the MSVCR100.dll handle is available via LoadLibraryA(), the following code writes the handle to the target address in the heap (actually the fake stack), which is used to call GetProcAddress() as the first parameter. The address is 0x1184c0e4.<\/p>\n 1184c0b4\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6b237664 6b218551 cccc022c<\/strong><\/p>\n 1184c0c4\u00a0 6b022c74 6b19567b 6ad6ed72 6b1d943b<\/strong><\/p>\n 1184c0d4\u00a0 6b16d51a<\/strong><\/p>\n <\/p>\n 6b237664 91\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 xchg\u00a0\u00a0\u00a0 eax,ecx<\/p>\n 6b237665 c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6b218551 58\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 pop\u00a0\u00a0\u00a0\u00a0 eax<\/p>\n 6b218552 c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6b022c74 0fb7c0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 movzx\u00a0\u00a0 eax,ax<\/p>\n 6b022c77 c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6b19567b 97\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 xchg\u00a0\u00a0\u00a0 eax,edi<\/p>\n 6b19567c c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6ad6ed72 01f7\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 add\u00a0\u00a0\u00a0\u00a0 edi,esi<\/p>\n 6ad6ed74 c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6b1d943b 57\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 push\u00a0\u00a0\u00a0 edi<\/p>\n 6b1d943c 58\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 pop\u00a0\u00a0\u00a0\u00a0 eax<\/p>\n 6b1d943d c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6b16d51a 8908\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0mov\u00a0\u00a0\u00a0\u00a0 dword ptr [eax],ecx<\/p>\n 6b16d51c c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n Next the process calls the following gadgets to get function pointers for the wcsstr function. The first parameter is a DLL handle received from previous gadgets.<\/p>\n 1184c0d4\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6b218551 6b32b1ec 6b1d92ac<\/strong><\/p>\n <\/p>\n 6b218551 58\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 pop\u00a0\u00a0\u00a0\u00a0 eax<\/p>\n 6b218552 c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n <\/p>\n 6b1d92ac ff10\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 call\u00a0\u00a0\u00a0 dword ptr [eax]<\/p>\n 6b1d92ae c3\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ret<\/p>\n Now it\u2019s time to call the function with the jmp eax gadget.<\/p>\n 1184c0e4\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a06acce598<\/strong><\/p>\n <\/p>\n 6acce598 ffe0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 jmp\u00a0\u00a0\u00a0\u00a0 eax {MSVCR100!wcsstr (6c5f20f1)}<\/p>\n Here the code searches for the string \u201cMODULE\u201d from the heap or the fake stack. There is a long string in the heap following the \u201cMODULE\u201d signature. This is the encoded and compressed DLL D.T. With more gadgets, the code calls CryptStringToBinaryA() to convert this string to binary, and then calls RtlDecompressBuffer() to decompress the binary to the real D.T binary code in memory.<\/p>\n Similar ROP gadgets get ntdll.dll and related API addresses, for example, RtlDecompressBuffer() and CryptStringToBinaryA(). Finally, the ROP gadget calls GetTempPathA() to get the current temp path, the sandboxed path. It will create D.T under this path and call LoadLibraryA() to run the D.T. module.<\/p>\n D.T creates two threads. One shows error messages. The second creates and loads the DLL L2P.T, which exploits the second vulnerability to load L2P.T into a nonsandboxed acrord32 process. Finally this process terminates.<\/p>\n <\/p>\n Second Exploit<\/b><\/p>\n The second exploit triggers the vulnerability at acrord32.exe:<\/p>\n Due to a heap overflow, the eax register calls to the stack-pivoting ROP gadget.<\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP1.jpg\")
<\/a><\/p>\nAttack Path<\/b><\/h2>\n
![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP2.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP3.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP4.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP5.jpg\")
<\/a><\/p>\nFirst Exploit <\/b><\/h2>\n
![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP6.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP7.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP8.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP9.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP10.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP11.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP12.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP13.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP14.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP15.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP16.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP17.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP18.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP19.jpg\")
<\/a><\/p>\n\n
![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP20.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP21.jpg\")
<\/a><\/p>\n![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP22.jpg\")
<\/a><\/p>\n
![\"Szor](\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2013\/05\/Szor-ROP23.jpg\")
<\/a><\/p>\n