Vulnerability 61120 - CERT Civis.Net

Vulnerability Name:

CCN-61120

Published:

2010-08-10

Updated:

2010-08-10

Summary:

Multiple applications using the Portable Document Format (PDF) specification could provide weaker than expected security that could open the possibility for signature-collision attacks. An attacker could exploit this weakness to create PDF documents containing forged signatures that would incorrectly be identified as legitimate and trustworthy by various products that conform to the Portable Document Format (PDF) specification for signing PDF documents.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.5 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:U/RC:UR)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Consequences:

Other

References:

Source: CCN
Type: florz Web site
Collisions in PDF Signatures

Source: CCN
Type: BID-42377
Portable Document Format Specification Signature Collision Vulnerability

Source: XF
Type: UNKNOWN
pdf-weak-security(61120)

Vulnerable Configuration:

Configuration CCN 1:

cpe:/a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.1::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.2::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.3::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.4::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.5::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.6::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.7::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.8::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.0.9::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.1::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:8.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.1.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:7.1.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:8.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:7.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:8.1.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.0.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.3::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.4::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:7.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:8.1.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:8.1.7:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.7:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:8.1.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.3.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:spelling_dictionaries_support_for_adobe_reader:8.0.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.1.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:8.0.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.3.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.2.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.3.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.3.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:reader:9.3.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.3.3:*:*:*:*:*:*:*

AND

cpe:/a:adobe:acrobat:6.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.0::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.1.2::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.0::professional:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:7.1::professional:*:*:*:*:*

OR cpe:/a:adobe:reader:6.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:9.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:8.2:*:*:*:*:*:*:*

Denotes that component is vulnerable