Check Point Advisories

Adobe Download Manager AOM File Section Name Buffer Overflow (CVE-2006-5856)

Vulnerability
Protection

Check Point Reference:	CPAI-2006-285
Date Published:	30 Sep 2009
Severity:	High
Last Updated:	Wednesday 30 September, 2009
Source:
Industry Reference:	CVE-2006-5856
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Adobe produces and distributes a custom Download Manager utility which is usually utilized for Adobe product updates and downloads. The Download Manager normally sets up file association entries in the Windows registry upon installation that associate it with the AOM file type. A buffer overflow vulnerability exists in the Adobe Download Manager application. The problem exists in the component responsible for parsing of the AOM file format. A remote attacker may exploit this vulnerability to divert the process flow of the affected application to the injected code, causing arbitrary code execution in the context of the currently logged in user. If an attack attempt is unsuccessful in injecting and executing arbitrary code, the vulnerable Adobe Download Manager might terminate abnormally. If a code execution attempt is carried out successfully, the behaviour of the target host is dependent on the intention of the injected code. The injected code is executed within the security context of current user. Note that exploitation of the vulnerability leaves a malicious INI file on the local file system. The affected service will attempt to parse the malicious INI file save on the local file system every time it is being restarted, preventing a normal start up. The malicious INI file must be removed or edited manually for the affected application to be able to continue the normal operation.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Adobe Download Manager AOM File Section Name Buffer Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Adobe Products Violation.
Attack Information: Adobe Download Manager AOM file section name buffer overflow