|
Adobe Acrobat Reader weak digital signature implementation
|
|
|
|
|
Secunia Advisory:
|
SA8247
|
|
|
Release Date:
|
2003-03-07
|
|
Last Update:
|
2003-07-09
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Spoofing
Manipulation of data
|
|
Where:
|
From remote
|
|
Solution Status:
|
Unpatched
|
|
| Software: | Adobe Acrobat 4.x
Adobe Acrobat 5.x
Adobe Acrobat 6.x
Adobe Acrobat Reader 4.x
Adobe Acrobat Reader 5.x
Adobe Reader 6.x
|
|
|
This advisory is currently marked as unpatched!
- Companies can be alerted when a patch is released! |
|
|
Description:
Adobe has made a weak implementation of digital signatures in their Adobe Document Server for Reader Extensions, which allows malicious people to alter digitally signed documents and make them appear as if they where untampered.
While this isn't trivial to perform, it is relatively easy as the significant amount of data used to calculate the signature only is 18 bits.
This only affects users of Adobe Acrobat Reader 5.1 and later, because earlier versions don't support this type of digital signing.
Solution:
We recommend that you do not rely on the digital signature in PDF documents.
Secunia recommends that you use other means of digital signing such as pgp, gpg, and md5 to verify the authenticity of electronical documents.
Provided and/or discovered by:
Vladimir Katalov (ElcomSoft)
Changelog:
2003-09-07: Affected systems updated.
Original Advisory:
ElcomSoft has posted a detailed description of the poor implementation on VulnWatch, with the subject: "Implementation flaws in Adobe Document Server for Reader Extensions".
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
18 Related Secunia Security Advisories, displaying 10
|
|
|
1. Adobe Reader Unspecified Heap Corruption Vulnerability
|
|
2. Adobe Reader / Acrobat Multiple Vulnerabilities
|
|
3. Adobe Acrobat / Adobe Reader Insecure Default Permissions
|
|
4. Adobe Acrobat Buffer Overflow Vulnerability
|
|
5. Adobe Acrobat / Reader Plug-in Buffer Overflow Vulnerability
|
|
6. Adobe Acrobat Reader UnixAppOpenFilePerform Buffer Overflow Vulnerability
|
|
7. Adobe Reader / Adobe Acrobat Local Files Detection and Denial of Service
|
|
8. Adobe Reader for Linux Insecure Temporary File Creation
|
|
9. Adobe Acrobat Reader "mailListIsPdf()" Function Buffer Overflow
|
|
10. Adobe Reader / Adobe Acrobat Multiple Vulnerabilities
|
Show all related advisories
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
