How can the geometry of a JPG 2000 image within a PDF execute code when opening it in Adobe Reader?

Question

I work in incident handling/threat analysis and our events are based on Snort rules built from CVEs. I'm researching a particular event and I'm wanting to understand what exactly the vulnerability is, how it can be exploited, and how I can make a determination on whether an event is valid or a false positive.

We have long since patched Adobe Reader with updates that supersede the known vulnerable versions, so I'm not worried too much about it but I don't want malicious PDFs sitting on the network. That's why I want to identify whatever it is that causes it to be flagged.

I have the Snort rule broken into parts and I'm learning about how PCREs are used in content: but that is outside of the scope of this question. I just wanted to add that in there before someone says "look into the Snort rule and see what it is looking for."

The CVE I'm referencing is CVE-2013-0621 (FILE-PDF Adobe Acrobat Reader incomplete JP2K image geometry potentially malicious PDF detected) but there isn't really much information on it other than recommended fix actions, related vulnerabilities, and susceptible versions.

I don't know if the vulnerability is within the JP2K format that allows it to take advantage of a known Adobe Reader issue or if the payload is embedded into the PDF.

Any insight would be very helpful.

Answer 1

The exploit is simply titled based on what portion of the file must be mangled in order to cause a buffer overflow. If you read the SecurityFocus post, you'll see that it says:

Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely cause denial-of-service conditions.

In other words, an attacker would mangle (or replace the original value with an extremely large value) in order to cause a buffer overflow, and then cause a DoS (the advisory does not mention any scope for an attacker to execute code)