BUG: avast 6.0.1367 causes CRASH in adobe reader when opening signed pdf files

Avast Free Antivirus / Premium Security
1

When attempting to open ANY PDF file signed with a qualified digital signature, avast 6.0.1367 causes a crash in Adobe Reader.
Setting the behavior shield in avast to disabled allows opening the document normally.

Problem signature:
Problem Event Name: BEX
Application Name: AcroRd32.exe
Application Version: 10.1.1.33
Application Timestamp: 4e64e4e2
Fault Module Name: StackHash_0a9e
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 00000000
Exception Offset: 00000000
Exception Code: c0000005
Exception Data: 00000008
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 1048
Additional Information 1: 0a9e
Additional Information 2: 0a9e372d3b4ad19135b953a78882e789
Additional Information 3: 0a9e
Additional Information 4: 0a9e372d3b4ad19135b953a78882e789

I verified this with adobe reader 9.4.0, 9.4.6 and 10.1.1 and i tested it on both x86 and x64 versions of Win7 SP1.

to reproduce:
get any pdf file that is signed with a qualified digital signature certificate, try to open it while the avast behavior shield is on and off.

With the shield disabled adobe reader opens normally.
With the shield enabled adobe crashes when it tries to open the signed pdf file.

http://oi39.tinypic.com/mrv8r6.png

2

To save some time, do you have any links for such a signed PDF?

3

just a moment, uploading it now

Edit: uploaded it in a password-protected 7zip file at:

http://dl.transfer.ro/signed_pdf__-_dual_signatures_-_user_and_digisign_certificate_authority-transfer_RO-01dec-3b58f3.7z

the server will delete the file automatically in 10 days

but i can’t send you the password via PM here on forum because i get the message
“You are not allowed to send personal messages.”

how do we proceed to send you the pw?

P.S. it might be needed to install the trust chain for Digisign.ro from here:
http://www.digisign.ro/en/services/trust_chain

and activating the trust chain in adobe. (preferences → security → advanced → windows integration → enable those 3 check boxes)

4

Got the file, thanks.
Could you upload the password, e.g. in a TXT file, to ftp://ftp.avast.com/incoming ?
There’s write-only access into that folder.

5

done. text file is uploaded.

22:26:56 Command: STOR signed pdf file causes crash in adobe reader.txt
22:26:56 Response: 150 Ok to send data.
22:26:56 Response: 226 File receive OK.
22:26:56 Status: File transfer successful, transferred 1.649 bytes in 1 second

P.S. i have also found that if i add the main adobe reader executable (…\AcroRd32.exe) to the behavior shield’s trusted processes list the crash is avoided also since this effectively disables the shield for the reader, but i’d rather not leave the reader process unverified.

6

Hello,

it happens with all versions (i could find/hear of 6,8,9, i didn’t update to 10 yet)

it happens with all .pdf plain unsigned

it happens on launching the reader alone without a file to open

i am waiting for an answer from s.o. who DOESN’T have the problem (under Vista :slight_smile:
[EDIT] it doesn’t happen with 10.0.0 under Vista

i have attached drwts32_avast_reader.log
(oldest leanest version i have xp sp2 6.0.1)

i hope it helps.

i wish you good luck, many thx for this product!

cb