Actu
Vigil@nce: Acrobat 9, quickest brute force attack
December 2008 by Vigil@nce
An attacker can use a quickest brute force attack in order to
decrypt documents encrypted by Acrobat.
– Gravity: 1/4
– Consequences: data reading
– Provenance: document
– Means of attack: no proof of concept, no attack
– Ability of attacker: expert (4/4)
– Confidence: confirmed by the editor (5/5)
– Diffusion of the vulnerable configuration: high (3/3)
– Creation date: 08/12/2008
IMPACTED PRODUCTS
– Adobe Acrobat/Reader
DESCRIPTION
The Adobe Acrobat software can encrypt PDF documents.
Version 8 uses an encryption algorithm based on AES 128 bits.
Version 9 uses AES 256 bits, but its implementation was
"optimized" in order to quickly load documents.
However, this optimization can also be used for quickest brute
force attacks.
An attacker can therefore guess the valid password in less time
than for version 8.
CHARACTERISTICS
– Identifiers: BID-32610, CVE-2008-5331, VIGILANCE-VUL-8293
– Url: http://vigilance.fr/vulnerability/8293
