[Full-disclosure] Secunia Research: Adobe Document/Graphics Server File URI Resource Access

======================================================================

                 Secunia Research 15/03/2006

 - Adobe Document/Graphics Server File URI Resource Access -

======================================================================
Table of Contents

Affected Software…1
Severity…2
Description of Vulnerability…3
Solution…4
Time Table…5
Credits…6
References…7
About Secunia…8
Verification…9

======================================================================
1) Affected Software

• Adobe Graphics Server 2.x
• Adobe Document Server 5.x
• Adobe Document Server 6.x

Prior versions may also be affected.

======================================================================
2) Severity

Rating: Moderately Critical
Impact: System access
Manipulation of data
Exposure of sensitive information
Where: Local network

======================================================================
3) Description of Vulnerability

Secunia Research has discovered a vulnerability in Adobe Document
Server and Adobe Graphics Server, which can be exploited by malicious
people to gain knowledge of potentially sensitive information,
overwrite arbitrary files, or compromise a vulnerable system.

The "saveContent" and "saveOptimized" ADS (Adobe Document Server)
commands allow graphics or PDF files to be saved with any file
extensions to arbitrary locations on the server with SYSTEM privileges
(default settings) using File URIs. Similarly, the "loadContent"
command allows retrieving of graphics or PDF files specified using
File URIs. These commands are exposed via the AlterCast web service
running on port 8019.

This can be exploited by sending a specially crafted SOAP request to
the web service to write a graphics file containing malicious
JavaScript as metadata to e.g. the server's "All Users" startup
folder. The request can be constructed to save this graphics file
with a HTA extension causing the file to be executed the next time
any user logs in.

A request containing "loadContent" can also be sent to retrieve
arbitrary graphics or PDF files from the server, potentially exposing
sensitive information.

Successful exploitation requires that the service is configured to
run with SYSTEM privileges (default) or with privileges of a normal
user that has been granted interactive logon rights.

======================================================================
4) Solution

The vendor has published additional hardening steps to prevent
exploitation of the vulnerability (see vendor advisory for details).

======================================================================
5) Time Table

26/07/2005 - Initial vendor notification.
26/07/2005 - Initial vendor reply.
14/03/2006 - Vendor published additional hardening guidelines.
15/03/2006 - Public disclosure.

======================================================================
6) Credits

Discovered by Tan Chew Keong, Secunia Research.

======================================================================
7) References

Adobe:
http://www.adobe.com/support/techdocs/332989.html

The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2006-1182 for the vulnerability.

======================================================================
8) About Secunia

Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:

http://secunia.com/

Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/secunia_security_advisories/

======================================================================
9) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2005-28/advisory/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================

---

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/