PT-2020-5003 · Adobe · Acrobat Reader

Published 2020-11-03 · Updated 2021-09-08 · CVE-2020-24429

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Acrobat Reader DC versions 2020.012.20048 and earlier Adobe Acrobat Reader DC versions 2020.001.30005 and earlier Adobe Acrobat Reader DC versions 2017.011.30175 and earlier

Description The issue is related to a signature verification bypass that could result in local privilege escalation. Exploitation of this issue requires user interaction, where a victim must open a malicious file. This could allow an attacker to execute arbitrary code in the context of the current user and potentially elevate privileges using a specially crafted file.

Recommendations For Adobe Acrobat Reader DC versions 2020.012.20048 and earlier, update to a version that includes a fix for the signature verification bypass issue. For Adobe Acrobat Reader DC versions 2020.001.30005 and earlier, update to a version that includes a fix for the signature verification bypass issue. For Adobe Acrobat Reader DC versions 2017.011.30175 and earlier, update to a version that includes a fix for the signature verification bypass issue. As a temporary workaround, consider avoiding the use of Adobe Acrobat Reader DC to open files from untrusted sources until a patch is available.

Fix

LPE

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2020-05588

CVE-2020-24429

Affected Products

Acrobat Reader

References · 6

• https://osv.dev/vulnerability/CVE-2020-24429 · Vendor Advisory
• https://helpx.adobe.com/security/products/acrobat/apsb20-67.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05588 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-24429 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24429 · Note
• https://t.me/cvenotify/5373 · Telegram Post