VUPEN Security Research - Adobe Acrobat & Reader XI-X "AcroBroker" Sandbox Bypass (Pwn2Own)

VUPEN Security Research - Adobe Acrobat & Reader XI-X "AcroBroker"
Sandbox Bypass (Pwn2Own)

Website : http://www.vupen.com

Twitter : http://twitter.com/vupen

I. BACKGROUND

Adobe Acrobat and Reader are the global standards for electronic
document sharing. They are used to create, view, search, digitally
sign, verify, print, and collaborate on Adobe PDF files.

II. DESCRIPTION

VUPEN Vulnerability Research Team discovered a critical vulnerability
in Adobe Acrobat and Reader.

The vulnerability is caused by an input validation error in the
"AcroBroker.exe" component when processing local file paths, which
could be exploited by attackers to write malicious files to any
location on the disk and bypass Adobe Acrobat's sandbox.

III. AFFECTED PRODUCTS

Adobe Acrobat and Reader XI version 11.0.06 and prior
Adobe Acrobat and Reader XI version 10.1.9 and prior

IV. SOLUTION

Upgrade to Adobe Acrobat and Reader XI v11.0.07 or X v10.1.10.

V. CREDIT

This vulnerability was discovered by VUPEN Security.

VI. ABOUT VUPEN Security

VUPEN is the leading provider of defensive and offensive cyber security
intelligence and advanced zero-day research. All VUPEN's vulnerability
intelligence results exclusively from its internal and in-house R&D
efforts conducted by its team of world-class researchers.

VUPEN Solutions: http://www.vupen.com/english/services/

VII. REFERENCES

http://helpx.adobe.com/security/products/reader/apsb14-15.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0512

VIII. DISCLOSURE TIMELINE

2013-12-05 - Vulnerability Discovered by VUPEN Security
2014-03-13 - Vulnerability Reported to Adobe During Pwn2Own 2014
2014-05-13 - Vulnerability Fixed by Adobe
2014-05-26 - Public disclosure