CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS
Percentile
96.9%
The version of the Adobe Camera Raw plug-in installed on the remote host is affected by the following vulnerabilities :
A flaw exists when processing an LZW compressed TIFF image that can be exploited to cause a heap-based buffer underflow via a specially crafted LZW code within an image row strip. (CVE-2012-5679)
An integer overflow error exists when allocating memory during TIFF image processing that can be exploited to cause a heap-based buffer overflow via specially crafted image dimensions. (CVE-2012-5680)
These vulnerabilities can be exploited by tricking a user into opening a specially crafted file and could allow an attacker to execute arbitrary code.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(63300);
script_version("1.9");
script_set_attribute(attribute:"plugin_modification_date", value:"2022/04/11");
script_cve_id("CVE-2012-5679", "CVE-2012-5680");
script_bugtraq_id(56922, 56924);
script_xref(name:"SECUNIA", value:"49929");
script_name(english:"Adobe Camera Raw Plug-In Multiple Vulnerabilities");
script_set_attribute(attribute:"synopsis", value:
"The remote host has a software plug-in installed that is affected by
multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"The version of the Adobe Camera Raw plug-in installed on the remote
host is affected by the following vulnerabilities :
- A flaw exists when processing an LZW compressed TIFF
image that can be exploited to cause a heap-based buffer
underflow via a specially crafted LZW code within an
image row strip. (CVE-2012-5679)
- An integer overflow error exists when allocating memory
during TIFF image processing that can be exploited to
cause a heap-based buffer overflow via specially crafted
image dimensions. (CVE-2012-5680)
These vulnerabilities can be exploited by tricking a user into opening
a specially crafted file and could allow an attacker to execute
arbitrary code.");
script_set_attribute(attribute:"see_also", value:"http://secunia.com/secunia_research/2012-31/");
script_set_attribute(attribute:"see_also", value:"http://www.adobe.com/support/security/bulletins/apsb12-28.html");
script_set_attribute(attribute:"solution", value:
"Upgrade to Camera Raw Plug-In 6.7.1 / 7.3 or later.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-5680");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2012/12/12");
script_set_attribute(attribute:"patch_publication_date", value:"2012/12/12");
script_set_attribute(attribute:"plugin_publication_date", value:"2012/12/19");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:bridge");
script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:photoshop");
script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:camera_raw");
script_set_attribute(attribute:"thorough_tests", value:"true");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Windows");
script_copyright(english:"This script is Copyright (C) 2012-2022 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("smb_hotfixes.nasl");
script_require_keys("SMB/Registry/Enumerated");
script_require_ports(139, 445);
exit(0);
}
include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc"); # for hotfix_path2share
include("misc_func.inc");
get_kb_item_or_exit("SMB/Registry/Enumerated");
appname = 'Adobe Camera Raw Plug-In';
report = '';
vuln_files = 0;
plugin_found = FALSE;
cf_dir = hotfix_get_commonfilesdirx86();
if (!cf_dir) cf_dir = hotfix_get_commonfilesdir();
if (isnull(cf_dir) || !cf_dir) exit(1, 'Unable to obtain common program files directory.');
share = hotfix_path2share(path:cf_dir);
# Connect to the appropriate share.
name = kb_smb_name();
port = kb_smb_transport();
#if (!get_port_state(port)) audit(AUDIT_PORT_CLOSED, port);
login = kb_smb_login();
pass = kb_smb_password();
domain = kb_smb_domain();
#soc = open_sock_tcp(port);
#if (!soc) audit(AUDIT_SOCK_FAIL, port);
#session_init(socket:soc, hostname:name);
if(!smb_session_init()) audit(AUDIT_FN_FAIL, 'smb_session_init');
rc = NetUseAdd(login:login, password:pass, domain:domain, share:share);
if (rc != 1)
{
NetUseDel();
audit(AUDIT_SHARE_FAIL, share);
}
dirpat = ereg_replace(pattern:'^[A-Za-z]:(.*)', replace:"\1\Adobe\Plug-Ins\*", string:cf_dir);
plugin_name = 'Camera Raw.8bi';
# Search all Adobe products installed to see if they have Adobe Camera Raw Plug-In Installed
retx = FindFirstFile(pattern:dirpat);
while (!isnull(retx[1]))
{
if ((retx[2] & FILE_ATTRIBUTE_DIRECTORY) && retx[1] != '.' && retx[1] != '..' &&
retx[1] =~ "CS[56]")
{
plugins_dir = '\\Adobe\\Plug-Ins\\' + retx[1] + '\\File Formats\\';
plugin_path = ereg_replace(pattern:"^[A-Za-z]:(.*)", string:cf_dir, replace:"\1" + plugins_dir + plugin_name);
plugin_path_raw = cf_dir + plugins_dir + plugin_name;
handle = CreateFile(file:plugin_path, desired_access:GENERIC_READ, file_attributes:FILE_ATTRIBUTE_NORMAL, share_mode:FILE_SHARE_READ, create_disposition:OPEN_EXISTING);
if (!isnull(handle))
{
v = GetFileVersion(handle:handle);
CloseFile(handle:handle);
if (!isnull(v))
{
version = join(sep:'.', v);
plugin_found = TRUE;
fix = '';
if (version =~ "^6(\.|$)" && ver_compare(ver:version, fix:"6.7.1", strict:FALSE) == -1)
fix = "6.7.1";
else if (version =~ "^7(\.|$)" && ver_compare(ver:version, fix:"7.3", strict:FALSE) == -1)
fix = "7.3";
if (fix != '')
{
report += '\n Path : ' + plugin_path_raw +
'\n Installed version : ' + version +
'\n Fixed version : ' + fix + '\n';
vuln_files++;
if (!thorough_tests) break;
}
}
}
}
retx = FindNextFile(handle:retx);
}
NetUseDel();
if (report == '')
{
if (plugin_found) audit(AUDIT_INST_VER_NOT_VULN, appname);
else audit(AUDIT_NOT_INST, appname);
}
if (vuln_files > 1)
report = '\nThe following vulnerable Adobe plug-ins were found :\n' + report;
else
report = '\nThe following vulnerable Adobe plug-in was found :\n' + report;
if (report_verbosity > 0) security_hole(port:port, extra:report);
else security_hole(port);