I work in incident handling/threat analysis and our events are based on Snort rules built from CVEs. I'm researching a particular event and I'm wanting to understand what exactly the vulnerability is, how it can be exploited, and how I can make a determination on whether an event is valid or a false positive.
We have long since patched Adobe Reader with updates that supersede the known vulnerable versions, so I'm not worried too much about it but I don't want malicious PDFs sitting on the network. That's why I want to identify whatever it is that causes it to be flagged.
I have the Snort rule broken into parts and I'm learning about how PCREs are used in
content: but that is outside of the scope of this question. I just wanted to add that in there before someone says "look into the Snort rule and see what it is looking for."
The CVE I'm referencing is CVE-2013-0621 (FILE-PDF Adobe Acrobat Reader incomplete JP2K image geometry potentially malicious PDF detected) but there isn't really much information on it other than recommended fix actions, related vulnerabilities, and susceptible versions.
I don't know if the vulnerability is within the JP2K format that allows it to take advantage of a known Adobe Reader issue or if the payload is embedded into the PDF.
Any insight would be very helpful.