Signature Detail

HTTP: PDF File with Obfuscated Javascript

This signature detects PDF files containing JavaScript code that has been obfuscated. This is a technique frequently used by malicious PDFs to avoid detection.

Extended Description

Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2718, CVE-2013-2719, CVE-2013-2720, CVE-2013-2721, CVE-2013-2722, CVE-2013-2723, CVE-2013-2725, CVE-2013-2726, CVE-2013-2731, CVE-2013-2732, CVE-2013-2734, CVE-2013-2735, CVE-2013-2736, CVE-2013-3337, CVE-2013-3338, CVE-2013-3339, CVE-2013-3340, and CVE-2013-3341.

Affected Products

• Adobe acrobat 10.0
• Adobe acrobat 10.0.1
• Adobe acrobat 10.0.2
• Adobe acrobat 10.0.3
• Adobe acrobat 10.1
• Adobe acrobat 10.1.1
• Adobe acrobat 10.1.2
• Adobe acrobat 10.1.3
• Adobe acrobat 10.1.4
• Adobe acrobat 10.1.5
• Adobe acrobat 10.1.6
• Adobe acrobat 11.0
• Adobe acrobat 11.0.1
• Adobe acrobat 11.0.2
• Adobe acrobat 9.0
• Adobe acrobat 9.1
• Adobe acrobat 9.1.1
• Adobe acrobat 9.1.2
• Adobe acrobat 9.1.3
• Adobe acrobat 9.2
• Adobe acrobat 9.3
• Adobe acrobat 9.3.1
• Adobe acrobat 9.3.2
• Adobe acrobat 9.3.3
• Adobe acrobat 9.3.4
• Adobe acrobat 9.4
• Adobe acrobat 9.4.1
• Adobe acrobat 9.4.2
• Adobe acrobat 9.4.3
• Adobe acrobat 9.4.4
• Adobe acrobat 9.4.5
• Adobe acrobat 9.4.6
• Adobe acrobat 9.4.7
• Adobe acrobat 9.5
• Adobe acrobat 9.5.1
• Adobe acrobat 9.5.2
• Adobe acrobat 9.5.3
• Adobe acrobat 9.5.4
• Adobe acrobat_reader 10.0
• Adobe acrobat_reader 10.0.1
• Adobe acrobat_reader 10.0.2
• Adobe acrobat_reader 10.0.3
• Adobe acrobat_reader 10.1
• Adobe acrobat_reader 10.1.1
• Adobe acrobat_reader 10.1.2
• Adobe acrobat_reader 10.1.3
• Adobe acrobat_reader 10.1.4
• Adobe acrobat_reader 10.1.5
• Adobe acrobat_reader 10.1.6
• Adobe acrobat_reader 11.0
• Adobe acrobat_reader 11.0.1
• Adobe acrobat_reader 11.0.2
• Adobe acrobat_reader 11.0.3
• Adobe acrobat_reader 9.0
• Adobe acrobat_reader 9.1
• Adobe acrobat_reader 9.1.1
• Adobe acrobat_reader 9.1.2
• Adobe acrobat_reader 9.1.3
• Adobe acrobat_reader 9.2
• Adobe acrobat_reader 9.3
• Adobe acrobat_reader 9.3.1
• Adobe acrobat_reader 9.3.2
• Adobe acrobat_reader 9.3.3
• Adobe acrobat_reader 9.3.4
• Adobe acrobat_reader 9.4
• Adobe acrobat_reader 9.4.1
• Adobe acrobat_reader 9.4.2
• Adobe acrobat_reader 9.4.3
• Adobe acrobat_reader 9.4.4
• Adobe acrobat_reader 9.4.5
• Adobe acrobat_reader 9.4.6
• Adobe acrobat_reader 9.4.7
• Adobe acrobat_reader 9.5
• Adobe acrobat_reader 9.5.1
• Adobe acrobat_reader 9.5.2
• Adobe acrobat_reader 9.5.3
• Adobe acrobat_reader 9.5.4

References

• BugTraq: 37331
• BugTraq: 44504
• CVE: CVE-2013-3346
• CVE: CVE-2009-4324
• URL: http://blog.fortinet.com/fuzz-my-life-flash-player-zero-day-vulnerability-cve-2010-3654/
• URL: http://feliam.wordpress.com/2010/02/11/flash-on-a-pdf-with-minipdf-py/
• URL: http://en.wikipedia.org/wiki/Portable_Document_Format
• URL: http://www.adobe.com/support/security/advisories/apsa10-05.html