HTTP: Adobe Acrobat Reader File Extension Buffer Overflow

This signature detects attempts to exploit a known vulnerability against Adobe Acrobat Reader. A malicious HTTP server can host an Adobe Acrobat file with an overly long extension; when a client opens this file in Adobe Acrobat Reader, the file triggers a buffer overflow, enabling the server to execute arbitrary code on the client.

Extended Description

Adobe Acrobat and Reader are prone to a stack-based buffer overflow vulnerability. This issue exists in routines that parse document filenames. A malformed file name may trigger this condition when the file is opened. If a user could be enticed to open an appropriately named document, this could potentially allow for remote code execution. This issue appears to affect Adobe Acrobat and Reader 6.x releases on Microsoft Windows platforms.

Affected Products

Adobe acrobat

References

BugTraq: 10696

CVE: CVE-2004-0632

Short Name

HTTP:STC:ADOBE:PDF-EXT-OF

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Adobe Acrobat Reader File Extension Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?