CVE-2014-0521 Adobe Reader vulnerability
This JavaScript based Adobe Reader vulnerability affects all versions of Adobe Reader on all platforms prior to version 11.0.07 (released on May 13, 2014). The bug was found by Gábor Molnár and was reported on March 10, 2014.
Advisories:
Presentations:
- Camp++ 2014 (English): video (soon), slides: html, pdf
- Ethical Hacking Conference 2014 Hungary (Hungarian): video, slides
Proof of Concept PDFs:
- cve-2014-0521-poc-1.pdf: Reading the C:\notes\passwords file and echoing the contents in an alert window.
- cve-2014-0521-poc-2.pdf: Reading the C:\notes\passwords file and sending the contents to a WebDAV server running on 192.168.56.1:9999 . This uses an undocumented API and is less reliable. For testing I recommend using PyWebDAV, a lightweight WebDAV server.