PT-2020-5002 · Adobe · Acrobat Reader

Published 2020-11-03 · Updated 2021-09-16 · CVE-2020-24439

Positive Technologies (AI Summary)

CVSS v3.1

2.8

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Acrobat Reader DC for macOS versions 2020.012.20048 and earlier Acrobat Reader DC for macOS versions 2020.001.30005 and earlier Acrobat Reader DC for macOS versions 2017.011.30175 and earlier

Description The issue is related to a security feature bypass in Adobe Reader and Acrobat, which can be exploited to bypass existing security restrictions. This is due to errors in cryptographic signature verification. Although the practical security impact is minimal, a defense-in-depth fix has been implemented to further harden the Adobe Reader update process.

Recommendations For Acrobat Reader DC for macOS versions 2020.012.20048 and earlier, update to a version that includes the defense-in-depth fix to harden the Adobe Reader update process. For Acrobat Reader DC for macOS versions 2020.001.30005 and earlier, update to a version that includes the defense-in-depth fix to harden the Adobe Reader update process. For Acrobat Reader DC for macOS versions 2017.011.30175 and earlier, update to a version that includes the defense-in-depth fix to harden the Adobe Reader update process.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2020-05587

CVE-2020-24439

Affected Products

Acrobat Reader

References · 7

• https://helpx.adobe.com/security/products/acrobat/apsb20-67.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05587 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-24439 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24439 · Vendor Advisory
• https://t.me/cibsecurity/15882 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24439 · Note
• https://t.me/cvenotify/5212 · Telegram Post