Vulnerabilities > CVE-2012-5680 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Adobe Camera RAW

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(63300);
  script_version("1.8");
  script_cvs_date("Date: 2019/12/04");

  script_cve_id("CVE-2012-5679", "CVE-2012-5680");
  script_bugtraq_id(56922, 56924);
  script_xref(name:"Secunia", value:"49929");

  script_name(english:"Adobe Camera Raw Plug-In Multiple Vulnerabilities");
  script_summary(english:"Checks version of plug-in");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a software plug-in installed that is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of the Adobe Camera Raw plug-in installed on the remote
host is affected by the following vulnerabilities :

  - A flaw exists when processing an LZW compressed TIFF
    image that can be exploited to cause a heap-based buffer
    underflow via a specially crafted LZW code within an
    image row strip. (CVE-2012-5679)

  - An integer overflow error exists when allocating memory
    during TIFF image processing that can be exploited to
    cause a heap-based buffer overflow via specially crafted
    image dimensions. (CVE-2012-5680)

These vulnerabilities can be exploited by tricking a user into opening
a specially crafted file and could allow an attacker to execute
arbitrary code.");
  script_set_attribute(attribute:"see_also", value:"http://secunia.com/secunia_research/2012-31/");
  script_set_attribute(attribute:"see_also", value:"http://www.adobe.com/support/security/bulletins/apsb12-28.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Camera Raw Plug-In 6.7.1 / 7.3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-5680");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/12/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/12/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/12/19");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:bridge");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:photoshop");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:camera_raw");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smb_hotfixes.nasl");
  script_require_keys("SMB/Registry/Enumerated");
  script_require_ports(139, 445);

  exit(0);
}

include("audit.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc"); # for hotfix_path2share
include("misc_func.inc");

get_kb_item_or_exit("SMB/Registry/Enumerated");

appname = 'Adobe Camera Raw Plug-In';
report = '';

vuln_files = 0;
plugin_found = FALSE;

cf_dir = hotfix_get_commonfilesdirx86();
if (!cf_dir) cf_dir = hotfix_get_commonfilesdir();
if (isnull(cf_dir) || !cf_dir) exit(1, 'Unable to obtain common program files directory.');

share = hotfix_path2share(path:cf_dir);

# Connect to the appropriate share.
name    =  kb_smb_name();
port    =  kb_smb_transport();
#if (!get_port_state(port)) audit(AUDIT_PORT_CLOSED, port);
login   =  kb_smb_login();
pass    =  kb_smb_password();
domain  =  kb_smb_domain();

#soc = open_sock_tcp(port);
#if (!soc) audit(AUDIT_SOCK_FAIL, port);

#session_init(socket:soc, hostname:name);

if(!smb_session_init()) audit(AUDIT_FN_FAIL, 'smb_session_init');


rc = NetUseAdd(login:login, password:pass, domain:domain, share:share);
if (rc != 1)
{
  NetUseDel();
  audit(AUDIT_SHARE_FAIL, share);
}

dirpat = ereg_replace(pattern:'^[A-Za-z]:(.*)', replace:"\1\Adobe\Plug-Ins\*", string:cf_dir);

plugin_name = 'Camera Raw.8bi';

# Search all Adobe products installed to see if they have Adobe Camera Raw Plug-In Installed
retx = FindFirstFile(pattern:dirpat);
while (!isnull(retx[1]))
{
  if ((retx[2] & FILE_ATTRIBUTE_DIRECTORY) && retx[1] != '.' && retx[1] != '..' &&
      retx[1] =~ "CS[56]")
  {
    plugins_dir = '\\Adobe\\Plug-Ins\\' + retx[1] + '\\File Formats\\';
    plugin_path = ereg_replace(pattern:"^[A-Za-z]:(.*)", string:cf_dir, replace:"\1" + plugins_dir + plugin_name);
    plugin_path_raw = cf_dir + plugins_dir + plugin_name;

    handle = CreateFile(file:plugin_path, desired_access:GENERIC_READ, file_attributes:FILE_ATTRIBUTE_NORMAL, share_mode:FILE_SHARE_READ, create_disposition:OPEN_EXISTING);
    if (!isnull(handle))
    {
      v = GetFileVersion(handle:handle);
      CloseFile(handle:handle);
      if (!isnull(v))
      {
        version = join(sep:'.', v);
        plugin_found = TRUE;

        fix = '';

        if (version =~ "^6(\.|$)" && ver_compare(ver:version, fix:"6.7.1", strict:FALSE) == -1)
          fix = "6.7.1";
        else if (version =~ "^7(\.|$)" && ver_compare(ver:version, fix:"7.3", strict:FALSE) == -1)
          fix = "7.3";

        if (fix != '')
        {
           report += '\n  Path              : ' + plugin_path_raw +
                     '\n  Installed version : ' + version +
                     '\n  Fixed version     : ' + fix + '\n';
           vuln_files++;
           if (!thorough_tests) break;
        }
      }
    }
  }
  retx = FindNextFile(handle:retx);
}

NetUseDel();

if (report == '')
{
  if (plugin_found) audit(AUDIT_INST_VER_NOT_VULN, appname);
  else audit(AUDIT_NOT_INST, appname);
}

if (vuln_files > 1)
  report = '\nThe following vulnerable Adobe plug-ins were found :\n' + report;
else
  report = '\nThe following vulnerable Adobe plug-in was found :\n' + report;

if (report_verbosity > 0) security_hole(port:port, extra:report);
else security_hole(port);

#TRUSTED a465268835d7918dad6a78f79e4b4e1bb26c202579cd376845dc39884949904efbd8ed66aca1a75c9d2086471ce2ce7480682ea57ff0d2e77a39c5ab6c88c3045a2bc96e5e181c60ae663f868443f1c02322aad540b974c2d814a51e2b44113ccf0124f85a853ed5ba3f9a8ac1db0d9b0fa4b954caf17243417477597deba7348115ce262b58a6029f4d9588cc9ca60e4ab50ca5355a31cebffd4b18e8ca5a7186a2595149013a24bda28aae9ceaf706a35dd6f211311bda121684255e27b52027cd8f06a0f9dc5b6f8093c73ed38ff55e3cdee74cdda9277c0472f2d82e72341c513d4a580e2fb1c60ad3ff0e696b7f32739a725c8b6f5c34b409bd6b7765ebfdf9ace10ba61a17002705debc3cf51fb95486c8545fd22a7f74b388a837aa751e2a977c4b3e678028e2047549aab9bfaecc8991bde28ead4b0192aab65403839c14abae11d95cf7b2d506745f3c7faa6a288e784bf6826c34b4b5758ed47d73f5b36c02898c967e71f01da740579f95adcb2ab48427f44d6fba6557dca11bb381819074d43e1452b61989eae6cc87e049fb4d7f0402cd6c8ebf278a78b9e7457b2012776dc6d1a3abe969c3a007ed8bf17c4900d7c97ec17ed491fb6fe5d41568a0c2795c20e4398efdc8a15d2f690dae24f9f40a6040ce3da34b49962a0076bfc22fafe64ee2d82b4c1d41b26cb160192c524a0d8711450a25169e9b23d0e8
#
# (C) Tenable Network Security, Inc.
#


include ("compat.inc");

if (description)
{
  script_id(69347);
  script_version("1.12");
  script_cvs_date("Date: 2019/11/27");

  script_cve_id("CVE-2012-5679", "CVE-2012-5680");
  script_bugtraq_id(56922, 56924);

  script_name(english:"Adobe Camera Raw Plugin Multiple Vulnerabilities (Mac OS X)");
  script_summary(english:"Checks version of plug-in");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a software plugin installed that is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of the Adobe Camera Raw plugin installed on the remote host
is affected by the following vulnerabilities :

  - A flaw exists when processing an LZW compressed TIFF
    image that can be exploited to cause a heap-based buffer
    underflow via a specially crafted LZW code within an
    image row strip. (CVE-2012-5679)

  - An integer overflow error exists when allocating memory
    during TIFF image processing that can be exploited to
    cause a heap-based buffer overflow via specially crafted
    image dimensions. (CVE-2012-5680)

These vulnerabilities can be exploited by tricking a user into opening a
specially crafted file and could allow an attacker to execute arbitrary
code.");
  script_set_attribute(attribute:"see_also", value:"http://secunia.com/secunia_research/2012-31/");
  script_set_attribute(attribute:"see_also", value:"http://www.adobe.com/support/security/bulletins/apsb12-28.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Camera Raw Plug-In 6.7.1 / 7.3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-5680");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/12/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/12/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/08/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:bridge");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:photoshop");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:camera_raw");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl", "command_builder_init.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("ssh_func.inc");
include("telnet_func.inc");
include("hostlevel_funcs.inc");
include("macosx_func.inc");
include("sh_commands_find.inc");


if(sshlib::get_support_level() >= sshlib::SSH_LIB_SUPPORTS_COMMANDS)
  enable_ssh_wrappers();
else disable_ssh_wrappers();

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
os = get_kb_item("Host/MacOSX/Version");
if (!os) audit(AUDIT_OS_NOT, "Mac OS X");

if (islocalhost())
{
  if (!defined_func("pread")) audit(AUDIT_FN_UNDEF,"pread");
  info_t = INFO_LOCAL;
}
else
{
  sock_g = ssh_open_connection();
  if (!sock_g) audit(AUDIT_FN_FAIL, 'ssh_open_connection');
  info_t = INFO_SSH;
}

err = '';
dirs = sh_commands::find('/Library/Application Support/Adobe/Plug-Ins', '-xautofs', '-tenb_fstype_exclusions', '-tenb_path_exclusions', '-name', 'CS[56]', '-mindepth', '1', '-maxdepth', '1', '-type', 'd');
if (dirs[0] == sh_commands::CMD_OK)
{
  dirs = dirs[1];
}
else if (dirs[0] == sh_commands::CMD_TIMEOUT)
{
  err = 'Find command timed out.';
}
else
{
  err = dirs[1];
}

if (info_t == INFO_SSH) ssh_close_connection();

if (!empty_or_null(err)) exit(1, err);

if (empty_or_null(dirs)) audit(AUDIT_NOT_INST, 'Adobe Photoshop Camera Raw');

report = '';

foreach dir (split(dirs, keep:FALSE))
{
  plist = dir + '/File Formats/Camera Raw.plugin/Contents/Info.plist';

  cmd =
    'plutil -convert xml1 -o - \'' + plist + '\' | ' +
    'grep -A 1 CFBundleVersion | ' +
    'tail -n 1 | ' +
    'sed \'s/.*<string>\\(.*\\)<\\/string>.*/\\1/g\'';

  version = exec_cmd(cmd:cmd);
  if (!isnull(version))
    version = str_replace(find:'f', replace:'.', string:version);

  not_vuln_list = make_list();
  if (!isnull(version) && version =~ '^[0-9\\.]+$')
  {
    if (version =~ "^6(\.|$)" && ver_compare(ver:version, fix:"6.7.1", strict:FALSE) == -1)
      fix = "6.7.1";
    else if (version =~ "^7(\.|$)" && ver_compare(ver:version, fix:"7.3", strict:FALSE) == -1)
      fix = "7.3";

    if (fix != '')
    {
      report += '\n  Path              : ' + dir +
                '\n  Installed version : ' + version +
                '\n  Fixed version     : ' + fix + '\n';
      if (!thorough_tests) break;
    }
    else not_vuln_list = make_list(not_vuln_list, version);
  }
}

if (report != '')
{
  if (report_verbosity > 0) security_hole(port:0, extra:report);
  else security_hole(0);
}
else audit(AUDIT_INST_VER_NOT_VULN, "Adobe Photoshop Camera Raw",
           join(not_vuln_list, sep:'/'));