PT-2020-5006 · Adobe · Acrobat Reader

Published 2020-11-03 · Updated 2021-09-08 · CVE-2020-24431

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Acrobat Reader DC versions 2020.012.20048 and earlier Adobe Acrobat Reader DC versions 2020.001.30005 and earlier Adobe Acrobat Reader DC versions 2017.011.30175 and earlier

Description The issue is related to a security feature bypass that could result in dynamic library code injection by the Adobe Reader process. Exploitation of this issue requires user interaction, where a victim must open a malicious file. This could allow an attacker to execute arbitrary code in the context of the current user using a specially crafted dynamic library. The vulnerability is associated with errors in the authorization procedure.

Recommendations For Adobe Acrobat Reader DC versions 2020.012.20048 and earlier, update to a version later than 2020.012.20048 to resolve the issue. For Adobe Acrobat Reader DC versions 2020.001.30005 and earlier, update to a version later than 2020.001.30005 to resolve the issue. For Adobe Acrobat Reader DC versions 2017.011.30175 and earlier, update to a version later than 2017.011.30175 to resolve the issue. As a temporary workaround, consider avoiding the use of dynamic libraries in Adobe Reader until a patch is available.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2020-05591

CVE-2020-24431

Affected Products

Acrobat Reader

References · 7

• https://osv.dev/vulnerability/CVE-2020-24431 · Vendor Advisory
• https://helpx.adobe.com/security/products/acrobat/apsb20-67.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05591 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-24431 · Security Note
• https://t.me/cvenotify/5371 · Telegram Post
• https://t.me/cvenotify/5205 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24431 · Note