1

I work in incident handling/threat analysis and our events are based on Snort rules built from CVEs. I'm researching a particular event and I'm wanting to understand what exactly the vulnerability is, how it can be exploited, and how I can make a determination on whether an event is valid or a false positive.

We have long since patched Adobe Reader with updates that supersede the known vulnerable versions, so I'm not worried too much about it but I don't want malicious PDFs sitting on the network. That's why I want to identify whatever it is that causes it to be flagged.

I have the Snort rule broken into parts and I'm learning about how PCREs are used in content: but that is outside of the scope of this question. I just wanted to add that in there before someone says "look into the Snort rule and see what it is looking for."

The CVE I'm referencing is CVE-2013-0621 (FILE-PDF Adobe Acrobat Reader incomplete JP2K image geometry potentially malicious PDF detected) but there isn't really much information on it other than recommended fix actions, related vulnerabilities, and susceptible versions.

I don't know if the vulnerability is within the JP2K format that allows it to take advantage of a known Adobe Reader issue or if the payload is embedded into the PDF.

Any insight would be very helpful.

Improve this question

1 Answer 1

Reset to default
1

The exploit is simply titled based on what portion of the file must be mangled in order to cause a buffer overflow. If you read the SecurityFocus post, you'll see that it says:

Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely cause denial-of-service conditions.

In other words, an attacker would mangle (or replace the original value with an extremely large value) in order to cause a buffer overflow, and then cause a DoS (the advisory does not mention any scope for an attacker to execute code)

Improve this answer
1
  • That is helpful in understanding this more but it still generalizes the attack and its TTP. A "DoS condition" isn't very specific and it keeps the investigator from making targeted inquiries following an event. I understand that attacks will always vary but I'm looking for the tell, so to speak, when this event is triggered. Where in the JP2K image is it altered and how can I assess it to determine if it's indeed malicious.
    – Rincewind
    Jun 20, 2017 at 14:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .