|
Adobe Acrobat Reader weak digital signature implementation
|
|
Secunia Advisory:
|
SA8247
|
|
|
Release Date:
|
2003-03-07
|
|
Last Update:
|
2003-07-09
|
|
Popularity:
|
12,459 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Spoofing
Manipulation of data
|
|
Where:
|
From remote
|
|
Solution Status:
|
Unpatched
|
|
| Software: | Adobe Acrobat 4.x
Adobe Acrobat 5.x
Adobe Acrobat 6.x
Adobe Acrobat Reader 4.x
Adobe Acrobat Reader 5.x
Adobe Reader 6.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
Description:
Adobe has made a weak implementation of digital signatures in their Adobe Document Server for Reader Extensions, which allows malicious people to alter digitally signed documents and make them appear as if they where untampered.
While this isn't trivial to perform, it is relatively easy as the significant amount of data used to calculate the signature only is 18 bits.
This only affects users of Adobe Acrobat Reader 5.1 and later, because earlier versions don't support this type of digital signing.
Solution:
We recommend that you do not rely on the digital signature in PDF documents.
Secunia recommends that you use other means of digital signing such as pgp, gpg, and md5 to verify the authenticity of electronical documents.
Provided and/or discovered by:
Vladimir Katalov (ElcomSoft)
Changelog:
2003-09-07: Affected systems updated.
Original Advisory:
ElcomSoft has posted a detailed description of the poor implementation on VulnWatch, with the subject: "Implementation flaws in Adobe Document Server for Reader Extensions".
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
