Adobe Embedded JBIG2 Stream BO

March 3, 2009

Adobe products are used for creating, distributing, authoring and viewing Portable Document Format (PDF) documents. The Adobe Reader and Adobe Acrobat are examples of such products. The PDF file format was created and is controlled by Adobe. The format allows for representation of text, images and graphics in a single document.

Binary data, such as images are represented in a PDF document by stream objects. A stream is represented by a series of bytes enclosed in the stream and endstream keywords. An example of a stream in a PDF file is shown: 

 stream 0099009900990099 endstream

A stream will generally be preceded by a definition describing its properties amongst which will be the filter which is to be used to interpret the respective stream. For example, an image compressed by the JBIG2 compression standard may look as follows: 

 << /Type /XObject /Subtype /Image /Length 100 /Filter [ /ASCIIHexDecode /JBIG2Decode ] >>  stream 1847509384750293847593847594837495874939203948405 8459484379857032975402398650432986502398538754934 endstream

The JBIG2 bit stream consists of segments, with each segment containing a header followed by data. The format of a JBIG2 segment header is of variable length based on the values contained therein. In certain specific situations, the Adobe application will use a supplied value in the header as an index into an array of pages without checking the value for validity first. The application will then attempt to write into the array using this index. The affected field which is controlled by the PDF author, can be manipulated to overwrite any location within a 32-bit address space. This gives a malicious user the capability to corrupt memory of the affected process, thereby potentially diverting the process flow.

In order to exploit this vulnerability, the target user must be enticed to open a malicious PDF document. Successful exploitation may allow arbitrary code injection and execution with the privileges of the currently logged in user. As of the writing of this report, the vulnerability is being exploited in the wild.

SonicWALL has released three IPS signatures to detect and block specific exploit attempts. The following signatures have been released to address this vulnerability:

  • 5401 - Adobe Multiple Products Embedded JBIG2 Stream BO PoC 1
  • 5402 - Adobe Multiple Products Embedded JBIG2 Stream BO PoC 2
  • 5403 - Adobe Multiple Products Embedded JBIG2 Stream BO PoC 3