Adobe Graphics Server and Document Server unauthorized command access
| adobe-unauth-command-access (25247) |  Medium Risk |
Description:
Adobe Graphics Server versions 2.0 and 2.1 and Adobe Document Server versions 5.0 and 6.0 could allow a remote attacker to gain unauthorized access to privileged commands and write or view arbitrary files on the server. An attacker could send a specially-crafted SOAP request to the Web service running on port 8019 and use the "saveContent" or "saveOptimized" command to save malicious files to the server or use the "loadContent" command to view arbitrary files on the server with SYSTEM privileges. Successful exploitation of this vulnerability could lead to remote code execution.
Consequences:
Gain Access
Remedy:
Refer to Adobe Support Knowledgebase Document 332989 for suggested workaround information. See References.
References:
- Adobe Support Knowledgebase Document 332989: Security Advisory: Adobe Graphics Server and Adobe Document Server configuration security vulnerability.
- BID-17113: Adobe Graphics Server / Document Server Remote Command Execution Vulnerability
- CVE-2006-1182: Adobe Graphics Server 2.0 and 2.1 (formerly AlterCast) and Adobe Document Server (ADS) 5.0 and 6.0 allows local users to read files with certain extensions or overwrite arbitrary files and execute code via a crafted SOAP request to the AlterCast web service in which the request uses the (1) saveContent or (2) saveOptimized ADS commands, or the (3) loadContent command.
- OSVDB ID: 23924: Adobe Document/Graphics Server File URI Arbitrary Resource Manipulation
- SA19229: Adobe Document/Graphics Server File URI Resource Access
- SECTRACK ID: 1015768: Adobe Document Server Interactive Login Configuration Lets Remote Users Execute Arbitrary Code
- SECTRACK ID: 1015769: Adobe Graphics Server Interactive Login Configuration Lets Remote Users Execute Arbitrary Code
- VUPEN/ADV-2006-0956: Adobe Document and Graphics Server File URI Resource Access Issue
Platforms Affected:
- Adobe Document Server 5.0
- Adobe Document Server 6.0
- Adobe Graphics Server 2.0
- Adobe Graphics Server 2.1
- Microsoft Windows XP Professional
Reported:
Mar 15, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net