PT-2023-5323 · Adobe+1 · Acrobat+2
CVE-2023-29299
·
Publicado
2023-08-08
·
Atualizado
2023-08-15
CVSS v3.1
4.7
Média
| Vetor | AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Adobe Acrobat Reader versions 23.003.20244 and earlier
Adobe Acrobat Reader versions 20.005.30467 and earlier
Adobe Acrobat 2020
Adobe Acrobat Reader 2020
Description
The issue is related to an Untrusted Search Path vulnerability and improper input validation in Adobe Acrobat and Reader. This could lead to application denial-of-service. An attacker could leverage this vulnerability if the default PowerShell Set-ExecutionPolicy is set to Unrestricted. Exploitation requires user interaction, such as opening a malicious file, and can be achieved with a specially crafted PDF file.
Recommendations
For Adobe Acrobat Reader versions 23.003.20244 and earlier, update to a version later than 23.003.20244 to resolve the issue.
For Adobe Acrobat Reader versions 20.005.30467 and earlier, update to a version later than 20.005.30467 to resolve the issue.
For Adobe Acrobat 2020 and Adobe Acrobat Reader 2020, consider disabling the ability to open PDF files from untrusted sources until a patch is available.
As a temporary workaround, restrict the use of PowerShell with Unrestricted Set-ExecutionPolicy to minimize the risk of exploitation.
Correção
DoS
Untrusted Search Path
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Acrobat
Acrobat Reader
Powershell