Adobe Product Security Incident Response Team (PSIRT) Blog

A new version of the download manager for Adobe Reader is live. This new version resolves the Moderate local privilege escalation issue discussed in an Adobe PSIRT blog post on July 22.
No action is required for users downloading Adobe Reader from http://get.adobe.com/reader/. Users who previously downloaded Adobe Reader for Windows from http://get.adobe.com/reader/ can verify they are not vulnerable to this download manager issue by checking the following:

• Ensure that the C:\Program Files\NOS folder and its contents are not present on your system.
• Click “Start” > “Run” and type “services.msc”. Ensure that “getPlus(R) Helper” from the list of services.

If the NOS files are found, the download manager issue can be mitigated by:

• Navigating to Start > Control Panel > Add or Remove Programs > Adobe Download Manager, and selecting Remove to remove the Adobe Download Manager from your system.

OR

• Deleting the C:\Program Files\NOS\ folder and its contents.

Note: As mentioned in a late July Adobe Security Bulletin and PSIRT blog post, we want to remind users Adobe is planning its next quarterly security update for Adobe Reader and Acrobat for Tuesday, October 13.
This posting is provided “AS IS” with no warranties and confers no rights.

Adobe has investigated the local privilege escalation issue with Adobe Reader that was recently posted to milw0rm and is working with the third party responsible for this component to develop a schedule for a fix. Affected versions are the full installer for Adobe Reader 9.1.0 and 8.1.3 for Windows (CVE-2009-2564). Please note that this is not related to CVE-2009-1862.
Here are some details based on our investigation:

• In the described exploit, an attacker could replace the getPlus_HelperSvc.exe file with malicious files that could potentially be executed in the context of Local System, resulting in a privilege escalation.
• The issue is only locally exploitable. This means that an attacker would have to already have access to the target computer.
• getPlus binaries are only used in the installation of Adobe Reader. The binaries delete themselves after reboot. Therefore, most users will not have these binaries present on their machine and will not be vulnerable.
• The attacker would have to be able to start the getPlus helper service, which is stopped after installation is complete, and can only be restarted manually by an Administrator or Power User.

We rate this vulnerability as ‘Moderate’ according to our Severity Rating System because:

• The vulnerable getPlus binaries will not exist on most machines since they are deleted after the first reboot after installation of Adobe Reader.
• The attacker must have local access to the machine to perform the attack.
• To perform the exploit, the attacker would have to be able to start the getPlus helper service, which is stopped after installation is complete, and can only be restarted manually by an Administrator or Power User.

Users can verify they are not vulnerable to this attack by checking the following:

• Ensure that the C:\Program Files\NOS folder and its contents are not present on your system
• Click “Start” > “Run” and type “services.msc”. Ensure that “getPlus(R) Helper” is not in the list of services

If the NOS files are found, the issue can be mitigated by:

• Deleting the C:\Program Files\NOS folder and its contents
• Click “Start” > “Run” and type “services.msc”. Delete “getPlus(R) Helper” from the list of services