PT-2021-5523 · Adobe · Premiere Rush

Published 2021-12-14 · Updated 2022-02-03 · CVE-2021-43746

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Premiere Rush versions 1.5.16 and earlier

Description The issue is related to the parsing of MP4 files, where a lack of proper initialization of memory prior to accessing it allows remote attackers to disclose sensitive information on affected installations. User interaction is required to exploit this vulnerability, where the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MP4 files.

Recommendations For Adobe Premiere Rush versions 1.5.16 and earlier, consider disabling the MP4 file parsing functionality until a patch is available. Restrict access to the MP4 file parsing module to minimize the risk of exploitation. Avoid opening malicious files or visiting malicious pages to prevent user interaction that could lead to exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Access of Uninitialized Pointer

RCE

Weakness Enumeration

CWE-824

CWE-20

Related Identifiers

BDU:2021-06373

CVE-2021-43746

ZDI-21-1557

ZDI-22-079

Affected Products

Premiere Rush

References · 10

• https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43746 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-1557 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43746 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-079 · Security Note
• https://bdu.fstec.ru/vul/2021-06373 · Security Note
• https://t.me/cvenotify/25555 · Telegram Post
• https://t.me/cvenotify/24711 · Telegram Post
• https://t.me/cibsecurity/34304 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021121603 · Note