PT-2020-6299 · Adobe · Acrobat+1

Published 2020-03-17 · Updated 2021-09-08 · CVE-2020-3803

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Acrobat versions prior to 2020.006.20034 Adobe Acrobat Reader versions prior to 2020.006.20034 Adobe Acrobat versions prior to 2017.011.30158 Adobe Acrobat Reader versions prior to 2017.011.30158 Adobe Acrobat versions prior to 2015.006.30510 Adobe Acrobat Reader versions prior to 2015.006.30510

Description The issue is related to insecure library loading, also known as dll hijacking, which can allow an attacker to escalate their privileges. Successful exploitation of this issue could lead to privilege escalation.

Recommendations For Adobe Acrobat and Reader versions prior to 2020.006.20034, update to a version later than 2020.006.20034. For Adobe Acrobat and Reader versions prior to 2017.011.30158, update to a version later than 2017.011.30158. For Adobe Acrobat and Reader versions prior to 2015.006.30510, update to a version later than 2015.006.30510. As a temporary workaround, consider restricting the loading of external libraries to minimize the risk of exploitation.

Fix

Uncontrolled Search Path Element

Untrusted Search Path

Weakness Enumeration

CWE-427

CWE-426

Related Identifiers

BDU:2021-04094

CVE-2020-3803

Affected Products

Acrobat

Acrobat Reader

References · 6

• https://helpx.adobe.com/security/products/acrobat/apsb20-13.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04094 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3803 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3803 · Security Note
• https://t.me/cvenotify/2149 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3803 · Note