PT-2021-6625 · Adobe · Creative Cloud

Published 2021-11-09 · Updated 2022-02-02 · CVE-2021-43017

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Adobe Creative Cloud versions 5.5 and earlier

Description The issue is related to an Application denial of service vulnerability in the Creative Cloud Desktop installer. An authenticated attacker with root privileges could leverage this vulnerability to achieve denial of service by planting a malicious file on the victim's local machine. The vulnerability is also associated with the creation of temporary files with insecure permissions. User interaction is required before product installation to abuse this vulnerability.

Recommendations For Adobe Creative Cloud versions 5.5 and earlier, consider disabling the Creative Cloud Desktop installer until a patch is available to prevent potential denial of service attacks. Restrict access to temporary files created by the installer to minimize the risk of exploitation. Avoid using the affected Creative Cloud Desktop Application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-379

Related Identifiers

BDU:2022-01941

CVE-2021-43017

Affected Products

Creative Cloud

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-43017 · Security Note
• https://helpx.adobe.com/security/products/creative-cloud/apsb21-111.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43017 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01941 · Security Note
• https://t.me/cvenotify/23499 · Telegram Post
• https://t.me/cvenotify/23441 · Telegram Post
• https://helpx.adobe.com/uk/security/products/creative-cloud/apsb21-111.html · Note
• https://t.me/cvenotify/23654 · Telegram Post
• https://t.me/cibsecurity/32656 · Telegram Post