module
Adobe Reader U3D Memory Corruption Vulnerability
| Disclosed | Created |
|---|---|
| 12/06/2011 | 05/30/2018 |
Disclosed
12/06/2011
Created
05/30/2018
Description
This module exploits a vulnerability in the U3D handling within
versions 9.x through 9.4.6 and 10 through to 10.1.1 of Adobe Reader.
The vulnerability is due to the use of uninitialized memory.
Arbitrary code execution is achieved by embedding specially crafted U3D
data into a PDF document. A heap spray via JavaScript is used in order to
ensure that the memory used by the invalid pointer issue is controlled.
versions 9.x through 9.4.6 and 10 through to 10.1.1 of Adobe Reader.
The vulnerability is due to the use of uninitialized memory.
Arbitrary code execution is achieved by embedding specially crafted U3D
data into a PDF document. A heap spray via JavaScript is used in order to
ensure that the memory used by the invalid pointer issue is controlled.
Authors
Felipe Andres Manzanosinn3r juan vazquez jduck
Platform
Windows
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:
msf > use exploit/windows/fileformat/adobe_reader_u3d
msf /(d) > show actions
...actions...
msf /(d) > set ACTION < action-name >
msf /(d) > show options
...show and set options...
msf /(d) > run
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.