PT-2020-6451 · Adobe · Genuine Service

Published 2020-07-14 · Updated 2022-07-26 · CVE-2020-9668

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Genuine Service versions 6.6 and earlier

Description The issue is related to improper access control when handling symbolic links, allowing an unauthenticated attacker to elevate privileges in the context of the current user. Additionally, there is a buffer overflow vulnerability in memory, which could enable a remote attacker to overwrite arbitrary files and gain elevated privileges.

Recommendations For Adobe Genuine Service versions 6.6 and earlier, as a temporary workaround, consider restricting access to the service until a patch is available. Avoid using the service for handling symbolic links until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2021-04930

CVE-2020-9668

Affected Products

Genuine Service

References · 7

• https://osv.dev/vulnerability/CVE-2020-9668 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9668 · Security Note
• https://bdu.fstec.ru/vul/2021-04930 · Security Note
• https://helpx.adobe.com/security/products/integrity_service/apsb20-42.html · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2020071419 · Note
• https://t.me/cvenotify/13387 · Telegram Post
• https://t.me/cvenotify/16784 · Telegram Post