PT-2021-6907 · Adobe · Acrobat Reader Dc Activex Control

Published 2021-09-14 · Updated 2022-02-05 · CVE-2021-39856

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Acrobat Reader DC ActiveX Control versions 2021.005.20060 (and earlier) Acrobat Reader DC ActiveX Control versions 2020.004.30006 (and earlier) Acrobat Reader DC ActiveX Control versions 2017.011.30199 (and earlier)

Description The issue is related to an Information Disclosure vulnerability that could allow an unauthenticated attacker to obtain NTLMv2 credentials. Exploitation of this issue requires user interaction, where a victim must visit an attacker-controlled web page. This vulnerability may also allow attackers to read arbitrary files from the file system.

Recommendations For versions 2021.005.20060 and earlier, update to a version later than 2021.005.20060 to resolve the issue. For versions 2020.004.30006 and earlier, update to a version later than 2020.004.30006 to resolve the issue. For versions 2017.011.30199 and earlier, update to a version later than 2017.011.30199 to resolve the issue. As a temporary workaround, consider restricting access to the NTLMv2 credentials until a patch is available. Avoid using the vulnerable Adobe Acrobat and Reader software to open untrusted PDF files until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-02568

CVE-2021-39856

Affected Products

Acrobat Reader Dc Activex Control

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-39856 · Security Note
• https://bdu.fstec.ru/vul/2022-02568 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39856 · Vendor Advisory
• https://helpx.adobe.com/security/products/acrobat/apsb21-55.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39856 · Note
• https://t.me/cibsecurity/29666 · Telegram Post
• https://t.me/cvenotify/22043 · Telegram Post