Vulnerability CVE-2007-0103 - CERT Civis.Net

Vulnerability Name:

CVE-2007-0103 (CCN-31364)

Assigned:

2007-01-06

Published:

2007-01-06

Updated:

2017-07-29

Summary:

The Adobe PDF specification 1.3, as implemented by Adobe Acrobat before 8.0.0, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.

CVSS v3 Severity:

9.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

7.6 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)
5.6 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2007-0102

Source: MITRE
Type: CNA
CVE-2007-0103

Source: MITRE
Type: CNA
CVE-2007-0104

Source: CCN
Type: Mac OS X 10.4.9 and Security Update 2007-003
About the security content of Mac OS X 10.4.9 and Security Update 2007-003

Source: CONFIRM
Type: UNKNOWN
http://docs.info.apple.com/article.html?artnum=305214

Source: CCN
Type: MOAB-06-01-2007
Multiple Vendor PDF Document Catalog Handling Vulnerability

Source: MISC
Type: UNKNOWN
http://projects.info-pull.com/moab/MOAB-06-01-2007.html

Source: CCN
Type: SA23799
KDE and KOffice PDF Invalid Tree Node Denial of Service Weakness

Source: CCN
Type: SA23813
Poppler Invalid Tree Node Denial of Service

Source: CCN
Type: SA24479
Mac OS X Security Update Fixes Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
24479

Source: CCN
Type: SECTRACK ID: 1017514
KDE kpdf Bug Lets Remote Users Deny Service

Source: CCN
Type: SECTRACK ID: 1017749
Apple Mac OS X CoreGraphics PDF File Processing Bug Lets Remote Users Deny Service

Source: CCN
Type: FreeDesktop.org CVS Repository
Poppler

Source: CCN
Type: Adobe Acrobat Reader Web site
Adobe

Source: CCN
Type: Apple Mac OS X Preview Web site
Apple - Mac OS X - PDF

Source: CCN
Type: Xpdf Web site
Xpdf

Source: CCN
Type: KDE Security Advisory 20070115-1
kpdf/kword/xpdf denial of service vulnerability

Source: CCN
Type: OSVDB ID: 31221
Multiple Vendor PDF Catalog Handling Memory Corruption

Source: CCN
Type: OSVDB ID: 32870
Multiple Products Adobe PDF Specification Malformed Catalog Dictionary DoS

Source: CCN
Type: OSVDB ID: 32871
Multiple Products Adobe PDF Specification Invalid Tree Node DoS

Source: BID
Type: Exploit
21910

Source: CCN
Type: BID-21910
Multiple PDF Readers Multiple Remote Buffer Overflow Vulnerability

Source: CCN
Type: BID-27740
Microsoft Publisher Memory Index Code Execution Vulnerability

Source: SECTRACK
Type: UNKNOWN
1017749

Source: CCN
Type: TLSA-2007-4
xpdf denial of service attack

Source: CCN
Type: USN-410-1
poppler vulnerability

Source: CCN
Type: USN-410-2
teTeX vulnerability

Source: CERT
Type: US Government Resource
TA07-072A

Source: VUPEN
Type: UNKNOWN
ADV-2007-0930

Source: XF
Type: UNKNOWN
multiple-vendor-pdf-code-execution(31364)

Source: XF
Type: UNKNOWN
multiple-vendor-pdf-code-execution(31364)

Source: SUSE
Type: SUSE-SR:2007:003
SUSE Security Summary Report

Vulnerable Configuration:

Configuration 1:

cpe:/a:adobe:acrobat_reader:*:*:*:*:*:*:*:* (Version <= 7.0.8)

Configuration CCN 1:

cpe:/a:apple:coregraphics:*:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*

OR cpe:/a:apple:preview:3.0.8:*:*:*:*:*:*:*

OR cpe:/a:adobe:pdf:1.3:*:*:*:*:*:*:*

OR cpe:/a:poppler:poppler:0.5.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:7.0.9:*:*:*:*:*:*:*

AND

cpe:/o:turbolinux:turbolinux:8:*:*:*:server:*:*:*

OR cpe:/o:turbolinux:turbolinux:10:*:*:*:desktop:*:*:*

OR cpe:/o:turbolinux:turbolinux:10:*:*:*:server:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*

OR cpe:/o:canonical:ubuntu:5.10:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2006:*:*:*:*:*:*:*

OR cpe:/o:canonical:ubuntu:6.06:*:lts:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2006:*:x86-64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2007:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:2007:*:x86_64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:x86_64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:x86_64:*:*:*:*:*

OR cpe:/o:canonical:ubuntu:6.10:*:*:*:*:*:*:*

OR cpe:/o:turbolinux:turbolinux:fuji:*:*:*:*:*:*:*

OR cpe:/o:turbolinux:turbolinux:*:*:personal:*:*:*:*:*

OR cpe:/o:turbolinux:turbolinux:*:*:home:*:*:*:*:*

OR cpe:/o:turbolinux:turbolinux:*:*:multimedia:*:*:*:*:*

Denotes that component is vulnerable