Adobe Photoshop ABR BO

May 28, 2010

Adobe Photoshop is a multi-platform graphics editor developed and published by Adobe Systems. Adobe Photoshop is capable of handling numerous types of image file formats. One of the formats it can handle is ABR. ABR is a proprietary file format which describes Adobe Photoshop brushes. An ABR file contains multiple structures describing a Photoshop brush. One of the structures contained is BrshObjc which contains the description of a brush stored in the following format:

Size Name Field ------------------------------------------------- 12 bytes DmtrUntF Diameter 12 bytes HrdnUntF Hardness 12 bytes AnglUntF Angle 12 bytes RndnUntF Roundness 12 bytes SpcnUntF Spacing 4 bytes Intrbool Interface 4 bytes flipXbool flipX 4 bytes flipYbool flipY

A buffer overflow vulnerability exists in Adobe Photoshop. The vulnerability is due to insufficient validation of the size of the AnglUntF structure. The vulnerable code uses the size value supplied in the Ang1UntF field as a parameter to the strncpy function. The vulnerable code will copy the specified number of bytes into a statically allocated heap buffer. This vulnerability can be exploited via numerous other file types that contain a brush definition.

In order to exploit this vulnerability remotely, an attacker must entice the target user to download and view a malicious file. Successful exploitation will result in a buffer overflow which may lead to process flow diversion within the context of the currently logged in user. In situations where code execution is not successful, the vulnerable application may terminate abnormally.

SonicWall has released an IPS signature to address a specific exploit targeting this vulnerability. The following signature has been released:

  • 5552 - Adobe Photoshop CS4 ABR File BO PoC

The vendor has released an advisory regarding this issue. The vulnerability has been assigned CVE-2010-1296 by mitre.