====================================================================== 

                     Secunia Research 15/03/2006

     - Adobe Document/Graphics Server File URI Resource Access -

====================================================================== 
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Description of Vulnerability.........................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Secunia........................................................8
Verification.........................................................9

====================================================================== 
1) Affected Software 

* Adobe Graphics Server 2.x
* Adobe Document Server 5.x
* Adobe Document Server 6.x

Prior versions may also be affected.

====================================================================== 
2) Severity 

Rating: Moderately Critical
Impact: System access 
        Manipulation of data
        Exposure of sensitive information
Where:  Local network

====================================================================== 
3) Description of Vulnerability

Secunia Research has discovered a vulnerability in Adobe Document 
Server and Adobe Graphics Server, which can be exploited by malicious
people to gain knowledge of potentially sensitive information,
overwrite arbitrary files, or compromise a vulnerable system.

The "saveContent" and "saveOptimized" ADS (Adobe Document Server)
commands allow graphics or PDF files to be saved with any file
extensions to arbitrary locations on the server with SYSTEM privileges
(default settings) using File URIs. Similarly, the "loadContent"
command allows retrieving of graphics or PDF files specified using
File URIs. These commands are exposed via the AlterCast web service
running on port 8019.

This can be exploited by sending a specially crafted SOAP request to
the web service to write a graphics file containing malicious
JavaScript as metadata to e.g. the server's "All Users" startup
folder. The request can be constructed to save this graphics file
with a HTA extension causing the file to be executed the next time 
any user logs in.

A request containing "loadContent" can also be sent to retrieve
arbitrary graphics or PDF files from the server, potentially exposing
sensitive information.

Successful exploitation requires that the service is configured to
run with SYSTEM privileges (default) or with privileges of a normal
user that has been granted interactive logon rights.

====================================================================== 
4) Solution 

The vendor has published additional hardening steps to prevent
exploitation of the vulnerability (see vendor advisory for details).

====================================================================== 
5) Time Table 

26/07/2005 - Initial vendor notification.
26/07/2005 - Initial vendor reply.
14/03/2006 - Vendor published additional hardening guidelines.
15/03/2006 - Public disclosure.

====================================================================== 
6) Credits 

Discovered by Tan Chew Keong, Secunia Research.

====================================================================== 
7) References

Adobe:
http://www.adobe.com/support/techdocs/332989.html 

The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2006-1182 for the vulnerability.

====================================================================== 
8) About Secunia 

Secunia collects, validates, assesses, and writes advisories regarding 
all the latest software vulnerabilities disclosed to the public. These 
advisories are gathered in a publicly available database at the 
Secunia website: 

http://secunia.com/ 

Secunia offers services to our customers enabling them to receive all 
relevant vulnerability information to their specific system 
configuration. 

Secunia offers a FREE mailing list called Secunia Security Advisories: 

http://secunia.com/secunia_security_advisories/ 

====================================================================== 
9) Verification 

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2005-28/advisory/ 

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/ 

=====================================================================