Adobe Document Server File URI Arbitrary Resource Manipulation

low Nessus Plugin ID 21100

Language:

Synopsis

The remote web server is affected by multiple flaws.

Description

The remote host is running Adobe Document Server, a server that dynamically creates and manipulates PDF documents as well as graphic images.

The version of Adobe Document Server installed on the remote host allows saving PDF and XML documents as well as most types of image files using file URIs to arbitrary locations on the affected host and with arbitrary extensions. An unauthenticated, remote attacker may be able to leverage this flaw to write a graphics image with malicious JavaScript as metadata into the Startup folders to be executed whenever a user logs in.

Additionally, it lets an attacker retrieve arbitrary PDF files, XML documents, and most types of image files, which may result in the disclosure of sensitive information.

Solution

Harden the application's configuration as described in the 'server/tools/security/readme.txt' file included in the distribution as well as the vendor advisory above.

Plugin Details

Severity: Low

ID: 21100

File Name: adobe_document_server_file_uri_access.nasl

Version: 1.24

Type: remote

Family: CGI abuses

Published: 3/18/2006

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.0

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 2.5

Vector: CVSS2#AV:L/AC:H/Au:N/C:P/I:P/A:N

Vulnerability Information

CPE: cpe:/a:adobe:document_server

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 3/15/2006

Vulnerability Publication Date: 3/15/2006

Reference Information

CVE: CVE-2006-1182

BID: 17113

Detections

Analytics