advisoriesvsecurity.com
Date: Wed May 24 2006 - 16:31:59 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

               Virtual Security Research, LLC.
                  http://www.vsecurity.com/
                      Security Advisory

- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Advisory Name: PDF Form Filling and Flattening Tool Buffer Overflow
 Release Date: 2006-05-23
  Application: PDF Tools AG - PDF Form Filling and Flattening Tool
      Version: 3.0 (Windows)
               (other versions and platforms untested)
     Severity: High
       Author: George D. Gal <ggal_at_vsecurity.com>
Vendor Status: Vendor Notified, Fix Available
CVE Candidate: CVE-2006-2549
    Reference:
       http://www.vsecurity.com/bulletins/advisories/2006/pdf-form-filling.txt
- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Product Description:

> From the pdf-tools.com website[1]:

 "PDF Tools AG is a world leader in PDF (The Adobe Portable Document Format)
  programming technology, delivering reliable PDF products to international
  customers in virtually all market segments."

 "PDF Form Filling and Flattening Tool is a command line tool that can
  create, edit, fill in and delete form fields in a PDF document."

Vulnerability Overview:

On April 18th, 2006 VSR has identified a stack overflow in the PDF Tools AG
PDF Form Filling and Flattening tool. Although this is a traditional
command line utility there may be a risk to those users of the application
who use it within web application or a network service, particularly when
relying on user supplied input to generate the PDF form field name or value
pairs.

In situations where user supplied input is used to populate a control file
of name value pairs without sufficient input validation the form field
names are susceptible to overflow. The buffer overflow occurs as a
direct result of unsafe string copy operations to a 256 byte fixed length
buffer. The binary is also susceptible to overflows of the PDF form field
names when specified on the command line instead of within a control file.

The following command may be used to check for the existence of the
vulnerability in the PDF form filling and flattening tool:

./pdformp.exe input.pdf output.pdf `perl -e 'print "A"x260;'`=foo

Vendor Response:

PDF Tools AG was first notified on 2006-04-19. The following time line
outlines the responses from the vendor regarding this issue:

 2006-04-20 - Acknowledgment of security notification received from VSR.
              Vendor stated that they only support registered customers
              of the product.
 2006-05-02 - Vendor response acknowledging overflow which will be
              resolved in the next pre-release version.
 2006-05-10 - Vendor response providing estimated release schedule.
 2006-05-15 - Vendor response notifying VSR of publicly released fix.
 
Recommendation:

PDF Tools AG customers should upgrade to the latest build of the PDF
Form Filling and Flattening tool (build 3.1.0.12) released on
May 10th 2006.

The upgrade is available via:

 http://www.pdf-tools.com/asp/products.asp?name=FF&type=shell

- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Common Vulnerabilities and Exposures (CVE) Information:

The Common Vulnerabilities and Exposures (CVE) project has assigned
the following names to these issues. These are candidates for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems.

  CVE-2006-2549

- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

References:

1. PDF Tools AG Form Filling and Flattening Tool
    http://www.pdf-tools.com/asp/products.asp?name=FF&type=shell

- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Vulnerability Disclosure Policy:

http://www.vsecurity.com/disclosurepolicy.html

- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Copyright 2006 Virtual Security Research, LLC. All rights reserved.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (FreeBSD)

iD8DBQFEdM8vTY6Rj3GeBOoRAkWkAJ4xArAz6lAV5VAAdhlUonIuXlTKcwCfTvQF
Wom0EDhnbI/8dkcr9F3ePfE=
=RPRL
-----END PGP SIGNATURE-----

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]