ETPRO EXPLOIT Adobe Acrobat Reader ACE.dll ICC mluc Integer Overflow

Info:  From Wireshark | Analyse | Follow | TCP Stream:

• GET /COUNCIL/Resources/Files/zta/2016/ZTA%2016-11.pdf HTTP/1.1
• Accept: text/html, application/xhtml+xml, */*
• Referer: http://www.montgomerycountymd.gov/council/leg/zta/index.html
• Accept-Language: en-US
• User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
• Accept-Encoding: gzip, deflate
• DNT: 1
• Host: www.montgomerycountymd.gov
• Cookie: _ga=GA1.2.72833851.1459860287; __utma=54704695.72833851.1459860287.1472146499.1472214826.68; __utmz=54704695.1470940322.59.7.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); fsr.r=%7B%22d%22%3A60%2C%22i%22%3A%22d13c751-131478546-c884-ca38-520d0%22%2C%22e%22%3A1471975284198%7D; _gat=1; _gat_clientTracker=1; fsr.s=%7B%22v1%22%3A-1%2C%22v2%22%3A-2%2C%22cp%22%3A%7B%22cxreplayaws%22%3A%22true%22%7D%2C%22rid%22%3A%22d13c751-131538676-8664-64f7-b2d80%22%2C%22to%22%3A4.6%2C%22c%22%3A%22http%3A%2F%2Fwww.montgomerycountymd.gov%2Fcouncil%2Fleg%2Fzta%2Findex.html%22%2C%22pv%22%3A7%2C%22lc%22%3A%7B%22d1%22%3A%7B%22v%22%3A2%2C%22s%22%3Atrue%7D%2C%22d0%22%3A%7B%22v%22%3A5%2C%22s%22%3Atrue%7D%7D%2C%22cd%22%3A0%2C%22sd%22%3A0%2C%22v%22%3A-1%2C%22f%22%3A1472214982877%7D; __utmb=54704695.5.10.1472214826; __utmc=54704695; __utmt=1; __atuvc=17%7C10%2C13%7C11%2C3%7C12%2C18%7C13%2C4%7C14; __atssc=google%3B10
• Connection: keep-alive
• Via: 1.1 HANK

• HTTP/1.1 200 OK
• Content-Type: application/pdf
• Last-Modified: Wed, 03 Aug 2016 18:02:44 GMT
• Accept-Ranges: bytes
• ETag: "03ae03bb1edd11:0"
• Server: Microsoft-IIS/7.5
• X-Powered-By: ASP.NET
• Date: Fri, 26 Aug 2016 12:36:23 GMT
• Content-Length: 317645

• %PDF-1.5
• %....
• 1 0 obj
• <</Type/Catalog/Pages 2 0 R/Lang(en-US) /StructTreeRoot 69 0 R/MarkInfo<</Marked true>>>>
• endobj
• 2 0 obj
• <</Type/Pages/Count 24/Kids[ 3 0 R 18 0 R 24 0 R 26 0 R 28 0 R 30 0 R 32 0 R 34 0 R 36 0 R 38 0 R 40 0 R 42 0 R 44 0 R 46 0 R 48 0 R 50 0 R 52 0 R 54 0 R 56 0 R 58 0 R 60 0 R 62 0 R 64 0 R 66 0 R] >>

 much more.....

• \Q.4Hu.N .n
• .h
• .P%.....P........N.0.%MQp/9.*AC........".6..K.a.P.#.[...S.ZO2..I.H.mLUc.....g.........Z;+..Q*..b.....~W.G.*/.!....O.~y..................v..+.K.RP."z..|.pY.RDx..f8....\.Iprp* ...0...b:....Dx.....=6 ...s....~.V.\g....-.+5....lQ.
• D.|:&.%..3.d...[O....:Z]z.....IO3.0a..~..rt......,R.#.V.g(.T.Za......AzJf.Y.....Y..".D.=IVI.......<l?..j......p.$SFd..j.|8g...y?

Description:

• http://telussecuritylabs.com/threats/show/TSL20101006-06
• http://www.zerodayinitiative.com/advisories/ZDI-10-192/
• http://seclists.org/fulldisclosure/2010/Oct/59

False Positive:

• YES
• Did a follow on the TCP stream from the full pcap.
• Searching through that output, there is a coincidental instance of the characters mluc.
• This does not appear as part of any markup, nor if it was present, does it guarantee that an exploit is in play.
• To get this document:
• http://www.montgomerycountymd.gov/COUNCIL/Resources/Files/zta/2016/ZTA%2016-11.pdf

Action:

• None