OSVDB ID: 15242

Title: Adobe Reader LoadFile() Method Local File Enumeration

Info

Disclosure
Apr 04, 2005

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 Adobe Reader contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a remote attacker calls the .LoadFile() method exposed by ActiveX in Internet Explorer via a malicious web page to trigger a flaw in Adobe Reader and disclose information on existence of local files in the target system resulting in a loss of confidentiality.

Classification

 Location: Remote / Network Access
Attack Type: Information Disclosure
Impact: Loss of Confidentiality

Solution

 Upgrade to version 7.0.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Adobe Systems Incorporated

Adobe Reader

 6.0.2
6.0.3
6.0.4
6.0.5
7.0
7.0.1
7.0.2
7.0.3
7.0.5
7.0.7
7.0.8

References

Credit
  • Hongzhen Zhou - felix__zhouhotmail.com -
  • Robert Fly - robflyhyperdose.com - Hyperdose Security


Direct URL: http://osvdb.org/15242