====================================================================== Secunia Research 15/03/2006 - Adobe Document/Graphics Server File URI Resource Access - ====================================================================== Table of Contents Affected Software....................................................1 Severity.............................................................2 Description of Vulnerability.........................................3 Solution.............................................................4 Time Table...........................................................5 Credits..............................................................6 References...........................................................7 About Secunia........................................................8 Verification.........................................................9 ====================================================================== 1) Affected Software * Adobe Graphics Server 2.x * Adobe Document Server 5.x * Adobe Document Server 6.x Prior versions may also be affected. ====================================================================== 2) Severity Rating: Moderately Critical Impact: System access Manipulation of data Exposure of sensitive information Where: Local network ====================================================================== 3) Description of Vulnerability Secunia Research has discovered a vulnerability in Adobe Document Server and Adobe Graphics Server, which can be exploited by malicious people to gain knowledge of potentially sensitive information, overwrite arbitrary files, or compromise a vulnerable system. The "saveContent" and "saveOptimized" ADS (Adobe Document Server) commands allow graphics or PDF files to be saved with any file extensions to arbitrary locations on the server with SYSTEM privileges (default settings) using File URIs. Similarly, the "loadContent" command allows retrieving of graphics or PDF files specified using File URIs. These commands are exposed via the AlterCast web service running on port 8019. This can be exploited by sending a specially crafted SOAP request to the web service to write a graphics file containing malicious JavaScript as metadata to e.g. the server's "All Users" startup folder. The request can be constructed to save this graphics file with a HTA extension causing the file to be executed the next time any user logs in. A request containing "loadContent" can also be sent to retrieve arbitrary graphics or PDF files from the server, potentially exposing sensitive information. Successful exploitation requires that the service is configured to run with SYSTEM privileges (default) or with privileges of a normal user that has been granted interactive logon rights. ====================================================================== 4) Solution The vendor has published additional hardening steps to prevent exploitation of the vulnerability (see vendor advisory for details). ====================================================================== 5) Time Table 26/07/2005 - Initial vendor notification. 26/07/2005 - Initial vendor reply. 14/03/2006 - Vendor published additional hardening guidelines. 15/03/2006 - Public disclosure. ====================================================================== 6) Credits Discovered by Tan Chew Keong, Secunia Research. ====================================================================== 7) References Adobe: http://www.adobe.com/support/techdocs/332989.html The Common Vulnerabilities and Exposures (CVE) project has assigned CVE-2006-1182 for the vulnerability. ====================================================================== 8) About Secunia Secunia collects, validates, assesses, and writes advisories regarding all the latest software vulnerabilities disclosed to the public. These advisories are gathered in a publicly available database at the Secunia website: http://secunia.com/ Secunia offers services to our customers enabling them to receive all relevant vulnerability information to their specific system configuration. Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/secunia_security_advisories/ ====================================================================== 9) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2005-28/advisory/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/ ======================================================================