51 lines
No EOL
2.1 KiB
Text
51 lines
No EOL
2.1 KiB
Text
########################################################################################
|
|
|
|
# Title: Adobe Digital Editions <= 4.5.0 - Critical memory corruption
|
|
# Application: Adobe Digital Editions
|
|
# Version: 4.5.0 and earlier versions
|
|
# Platform: Windows, Macintosh, iOS and Android
|
|
# Software Link: http://www.adobe.com/solutions/ebook/digital-editions.html
|
|
# Date: March 8, 2016
|
|
# CVE: CVE-2016-0954
|
|
# Author: Pier-Luc Maltais from COSIG
|
|
# Contact: https://twitter.com/COSIG_
|
|
# Personal contact: https://twitter.com/plmaltais
|
|
|
|
########################################################################################
|
|
|
|
===================
|
|
Introduction:
|
|
===================
|
|
Adobe® Digital Editions software offers an engaging way to view and manage eBooks and
|
|
other digital publications. Use it to download and purchase digital content, which can
|
|
be read both online and offline. Transfer copy-protected eBooks from your personal
|
|
computer to other computers or devices. Organize your eBooks into a custom library and
|
|
annotate pages. Digital Editions also supports industry-standard eBook formats,
|
|
including PDF/A and EPUB. (http://www.adobe.com/ca_fr/products/digital-editions.html)
|
|
|
|
########################################################################################
|
|
|
|
===================
|
|
Report Timeline:
|
|
===================
|
|
2015-10-24: Pier-Luc Maltais from COSIG found the issue and report it to Adobe PSIRT.
|
|
2016-03-08: Vendor fixed the issue (APSB16-06).
|
|
2016-03-08: Release of this advisory.
|
|
|
|
########################################################################################
|
|
|
|
===================
|
|
Technical details:
|
|
===================
|
|
A critical memory corruption occurs when Adobe Digital Editions handle a specially
|
|
crafted ExtGstate object, which could lead to remote code execution.
|
|
|
|
########################################################################################
|
|
|
|
==========
|
|
POC:
|
|
==========
|
|
https://plmsecurity.net/sites/plmsecurity.net/files/APSB16-06_PoC.pdf
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39533.zip
|
|
|
|
######################################################################################## |