WARLOCK

Dangerous - JBIG2 Adobe Acrobat Universal Exploit !

Disclaimer: This post is for research/education purposes only and AKATI Consulting (UK) Ltd. will not be held liable for anything that you do with this information. Hi Guys ! Here is something *dangerous* for you to learn and experiment with. This time, I thought I’d post about the recent JBIG2 Adobe Acrobat Universal Exploit (APSB09-01 (aka CVE-2009-0658)) The [...]

Disclaimer: This post is for research/education purposes only and AKATI Consulting (UK) Ltd. will not be held liable for anything that you do with this information.

Hi Guys ! Here is something *dangerous* for you to learn and experiment with.

This time, I thought I’d post about the recent JBIG2 Adobe Acrobat Universal Exploit (APSB09-01 (aka CVE-2009-0658))

The guys at Blacksecurity have written a very neat modification of the original blog post in the snort VRT blog posting (http://vrt-sourcefire.blogspot.com/2009/02/have-nice-weekend-pdf-love.html)

The actual bug stems from a pointer-indexing issue when utilizing a specifically crafted JBIG2 structure. And the Blasksec folks have made it available in a pdf format.

All you have to do is :

1. Download the exploit here (Please dont use Adobe Acrobat *grin* )

2. Execute it on the victim machine

3. Telnet from another machine to the victim machine on port 5500. (Yup ! The exploit binds a shell to port 5500 )

Have fun, folks !

Read more about how it is done here