Detected virus in pdf - should I be worried (CVE-2014-8449)?

Question

I downloaded a pdf earlier, and I was trying to send it to my friend, but gmail said that it detected a virus. So I ran it through virustotal.com and only 1 out of 56 scanners came up with a virus - ClamAV returned with "PDF.Exploit.CVE_2014_8449". None of the other 55 scanners came up with anything. I looked up CVE_2014_8449 and found this: "Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors". I'm not sure what this means, and should I be worried about this even though only 1 of the 56 scanners found this? How can I tell if this is an actual problem? Should I just get rid of the pdf?

Thank you!

Answer 1

CVE-2014-8449 "Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors"

This means that it was possible to provide a malicious pdf that, when opened with Adobe Acrobat Reader (older than those versions, when they fixed the bug), the attacker could execute malicious code (such as downloading and executing a more-advanced virus).

So yes, it's a reason to be worried. Could it be a false positive? Maybe. I don't know the certainty of that rule. I would certainly not open such file with a vulnerable version (unless I was attempting to trigger the virus).

Should I just get rid of the pdf?

Probably. Where does the pdf come from?

Answer 2

An integer overflow in Acrobat will be unlikely to occur in another viewer. I would advise installing VMWare Player, installing the latest Debian/Ubuntu/whatever Linux distribution you have handy in a VM, firing up the VM with network access disabled, opening the PDF file with Evince, printing it into PostScript and converting the PostScript into PDF.

Then, I'd check the resulting file via VirusTotal. Please consider the following piece of advice from Ross Ridge:

It's far from certain that the conversion process from PDF to PostScript and back to PDF wouldn't preserve the integer overflow exploit (assuming one actually exists in the document). PDF was designed in a way that makes conversion to PostScript trivial, the exploit would have a direct PostScript translation. The exploit could end up being translating back into PDF, if not in the exact same way as originally represented, in a compatible representation.

_{(emphasis mine - D.H.)}

EDIT: If the post-conversion check fails, just take the screenshots from inside the VM with your phone and send them to the friend. Time to be paranoid...

However, if you have no confidence in the origin of the file, and the information contained therein is not valuable enough to be sent as is, formatting included, to your friend, I'd simply dump the file rather than risk ruining the friendship.

Answer 3

The key thing to look for when you are analyzing a CVE is to first and foremost determine if your software is listed as being affected. If your software is not vulnerable, it doesn't mean you should necessarily be sharing the file because your friend may in fact be vulnerable and there may be some legal liability for knowingly sharing a malicious file.

The age of the file will also play an important factor here. If the PDF was created 5 years ago and you just recently downloaded it, the ClamAV finding is a false positive. This particular CVE is only a few months old and if we're seeing a PDF older than that, you are either dealing with super criminals or a false positive.

If you aren't affected and the file was only a few days old, consider it a learning experience and in the future only open files from respected locations.

Additionally, a question regarding a specific incident is difficult for the community to answer without additional findings, such as the origin of the file and a virus total link (Or other sandbox) to review behavioral observations.