SID 1:48293

Rule Category

FILE-PDF -- Snort has detected suspicious traffic related to a PDF file. PDFs are easily exploitable. They include many ways to encapsulate data and are often targeted by attackers, who use the PDF's household name status for social engineering. Therefore, Snort includes Many PDF-targeted rules.

Alert Message

FILE-PDF Adobe Acrobat Reader RegExp out of bounds read attempt

Rule Explanation

This event is generated when a malicious crafted PDF file designed to exploit Adobe Reader traverses the corporate network Impact: Attempted User Privilege Gain Details: A specific JavaScript code embedded in a PDF file can lead to a heap corruption when opening a PDF document in Adobe Acrobat Reader DC 2019.8.20071. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, victim would need to open the malicious file or access a malicious web page. Ease of Attack:

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group