Vulnerabilities > CVE-2016-1008 - Improper Input Validation vulnerability in Adobe products

CVSS 7.2 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

local

low complexity

nessus

NVD

Published: 2016-03-09

Updated: 2016-12-03

Summary

Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat and Acrobat Reader DC Continuous before 15.010.20060 on Windows and OS X allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.

Vulnerable Configurations

Part	Description	Count
Application	Adobe Adobe Acrobat - Adobe Acrobat 1.0 Adobe Acrobat 2.0 Adobe Acrobat 3.0 Adobe Acrobat 3.1 Adobe Acrobat 4.0 Adobe Acrobat 4.0.5 Adobe Acrobat 4.0.5A Adobe Acrobat 4.0.5C Adobe Acrobat 5.0 Adobe Acrobat 5.0.5 Adobe Acrobat 5.0.6 Adobe Acrobat 5.0.10 Adobe Acrobat 5.1 Adobe Acrobat 6.0 Adobe Acrobat 6.0.1 Adobe Acrobat 6.0.2 Adobe Acrobat 6.0.3 Adobe Acrobat 6.0.4 Adobe Acrobat 6.0.5 Adobe Acrobat 6.0.6 Adobe Acrobat 7 Adobe Acrobat 7.0 Adobe Acrobat 7.0.1 Adobe Acrobat 7.0.2 Adobe Acrobat 7.0.3 Adobe Acrobat 7.0.4 Adobe Acrobat 7.0.5 Adobe Acrobat 7.0.6 Adobe Acrobat 7.0.7 Adobe Acrobat 7.0.8 Adobe Acrobat 7.0.9 Adobe Acrobat 7.1.0 Adobe Acrobat 7.1.1 Adobe Acrobat 7.1.2 Adobe Acrobat 7.1.3 Adobe Acrobat 7.1.4 Adobe Acrobat 8 Adobe Acrobat 8.0 Adobe Acrobat 8.0.0 Adobe Acrobat 8.1 Adobe Acrobat 8.1.1 Adobe Acrobat 8.1.2 Adobe Acrobat 8.1.3 Adobe Acrobat 8.1.4 Adobe Acrobat 8.1.5 Adobe Acrobat 8.1.6 Adobe Acrobat 8.1.7 Adobe Acrobat 8.2 Adobe Acrobat 8.2.1 Adobe Acrobat 8.2.2 Adobe Acrobat 8.2.3 Adobe Acrobat 8.2.4 Adobe Acrobat 8.2.5 Adobe Acrobat 8.2.6 Adobe Acrobat 8.3 Adobe Acrobat 8.3.1 Adobe Acrobat 9 Adobe Acrobat 9.0 Adobe Acrobat 9.1 Adobe Acrobat 9.1.1 Adobe Acrobat 9.1.2 Adobe Acrobat 9.1.3 Adobe Acrobat 9.2 Adobe Acrobat 9.3 Adobe Acrobat 9.3.1 Adobe Acrobat 9.3.2 Adobe Acrobat 9.3.3 Adobe Acrobat 9.3.4 Adobe Acrobat 9.4 Adobe Acrobat 9.4.1 Adobe Acrobat 9.4.2 Adobe Acrobat 9.4.3 Adobe Acrobat 9.4.4 Adobe Acrobat 9.4.5 Adobe Acrobat 9.4.6 Adobe Acrobat 9.4.7 Adobe Acrobat 9.5 Adobe Acrobat 9.5.1 Adobe Acrobat 9.5.2 Adobe Acrobat 9.5.3 Adobe Acrobat 9.5.4 Adobe Acrobat 9.5.5 Adobe Acrobat 10.0 Adobe Acrobat 10.0.1 Adobe Acrobat 10.0.2 Adobe Acrobat 10.0.3 Adobe Acrobat 10.1 Adobe Acrobat 10.1.0 Adobe Acrobat 10.1.1 Adobe Acrobat 10.1.2 Adobe Acrobat 10.1.3 Adobe Acrobat 10.1.4 Adobe Acrobat 10.1.5 Adobe Acrobat 10.1.6 Adobe Acrobat 10.1.7 Adobe Acrobat 10.1.8 Adobe Acrobat 10.1.9 Adobe Acrobat 10.1.10 Adobe Acrobat 10.1.11 Adobe Acrobat 10.1.12 Adobe Acrobat 10.1.13 Adobe Acrobat 10.1.14 Adobe Acrobat 10.1.15 Adobe Acrobat 10.1.16 Adobe Acrobat 11.0 Adobe Acrobat 11.0.0 Adobe Acrobat 11.0.1 Adobe Acrobat 11.0.2 Adobe Acrobat 11.0.3 Adobe Acrobat 11.0.4 Adobe Acrobat 11.0.5 Adobe Acrobat 11.0.6 Adobe Acrobat 11.0.7 Adobe Acrobat 11.0.8 Adobe Acrobat 11.0.9 Adobe Acrobat 11.0.10 Adobe Acrobat 11.0.11 Adobe Acrobat 11.0.12 Adobe Acrobat 11.0.13 Adobe Acrobat 11.0.14 Adobe Acrobat _Reader9.5.3 Adobe Acrobat DC 15.000.0000 Adobe Acrobat DC 15.006.30033 Adobe Acrobat DC 15.006.30060 Adobe Acrobat DC 15.006.30094 Adobe Acrobat DC 15.006.30096 Adobe Acrobat DC 15.006.30097 Adobe Acrobat DC 15.006.30119 Adobe Acrobat DC 15.008.20082 Adobe Acrobat DC 15.009.20069 Adobe Acrobat DC 15.009.20071 Adobe Acrobat DC 15.009.20077 Adobe Acrobat DC 15.009.20079 Adobe Acrobat DC 15.010.20056 Adobe Acrobat DC 15.010.20059 Adobe Acrobat Reader - Adobe Acrobat Reader 3.0 Adobe Acrobat Reader 3.01 Adobe Acrobat Reader 3.02 Adobe Acrobat Reader 4.0 Adobe Acrobat Reader 4.0.5 Adobe Acrobat Reader 4.0.5A Adobe Acrobat Reader 4.0.5C Adobe Acrobat Reader 4.5 Adobe Acrobat Reader 5.0 Adobe Acrobat Reader 5.0.5 Adobe Acrobat Reader 5.0.6 Adobe Acrobat Reader 5.0.7 Adobe Acrobat Reader 5.0.9 Adobe Acrobat Reader 5.0.10 Adobe Acrobat Reader 5.0.11 Adobe Acrobat Reader 5.1 Adobe Acrobat Reader 6.0 Adobe Acrobat Reader 6.0.1 Adobe Acrobat Reader 6.0.2 Adobe Acrobat Reader 6.0.3 Adobe Acrobat Reader 6.0.4 Adobe Acrobat Reader 6.0.5 Adobe Acrobat Reader 7.0 Adobe Acrobat Reader 7.0.1 Adobe Acrobat Reader 7.0.2 Adobe Acrobat Reader 7.0.3 Adobe Acrobat Reader 7.0.4 Adobe Acrobat Reader 7.0.5 Adobe Acrobat Reader 7.0.6 Adobe Acrobat Reader 7.0.7 Adobe Acrobat Reader 7.0.8 Adobe Acrobat Reader 7.0.9 Adobe Acrobat Reader 7.1.0 Adobe Acrobat Reader 7.1.1 Adobe Acrobat Reader 8.0 Adobe Acrobat Reader 8.1 Adobe Acrobat Reader 8.1.1 Adobe Acrobat Reader 8.1.2 Adobe Acrobat Reader 8.1.3 Adobe Acrobat Reader 8.1.4 Adobe Acrobat Reader 8.1.5 Adobe Acrobat Reader 8.1.6 Adobe Acrobat Reader 8.1.7 Adobe Acrobat Reader 8.2 Adobe Acrobat Reader 8.2.1 Adobe Acrobat Reader 8.2.2 Adobe Acrobat Reader 8.2.3 Adobe Acrobat Reader 8.2.4 Adobe Acrobat Reader 8.2.6 Adobe Acrobat Reader 8.3 Adobe Acrobat Reader 9.0 Adobe Acrobat Reader 9.1 Adobe Acrobat Reader 9.1.1 Adobe Acrobat Reader 9.1.2 Adobe Acrobat Reader 9.1.3 Adobe Acrobat Reader 9.2 Adobe Acrobat Reader 9.3 Adobe Acrobat Reader 9.3.1 Adobe Acrobat Reader 9.3.2 Adobe Acrobat Reader 9.3.3 Adobe Acrobat Reader 9.3.4 Adobe Acrobat Reader 9.4 Adobe Acrobat Reader 9.4.1 Adobe Acrobat Reader 9.4.2 Adobe Acrobat Reader 9.4.3 Adobe Acrobat Reader 9.4.4 Adobe Acrobat Reader 9.4.5 Adobe Acrobat Reader 9.4.6 Adobe Acrobat Reader 9.4.7 Adobe Acrobat Reader 9.5 Adobe Acrobat Reader 9.5.1 Adobe Acrobat Reader 9.5.2 Adobe Acrobat Reader 9.5.3 Adobe Acrobat Reader 9.5.4 Adobe Acrobat Reader 9.5.5 Adobe Acrobat Reader 10.0 Adobe Acrobat Reader 10.0.1 Adobe Acrobat Reader 10.0.2 Adobe Acrobat Reader 10.0.3 Adobe Acrobat Reader 10.1 Adobe Acrobat Reader 10.1.0 Adobe Acrobat Reader 10.1.1 Adobe Acrobat Reader 10.1.2 Adobe Acrobat Reader 10.1.3 Adobe Acrobat Reader 10.1.4 Adobe Acrobat Reader 10.1.5 Adobe Acrobat Reader 10.1.6 Adobe Acrobat Reader 10.1.7 Adobe Acrobat Reader 10.1.8 Adobe Acrobat Reader 10.1.9 Adobe Acrobat Reader 10.1.10 Adobe Acrobat Reader 10.1.11 Adobe Acrobat Reader 10.1.12 Adobe Acrobat Reader 10.1.13 Adobe Acrobat Reader 10.1.14 Adobe Acrobat Reader 10.1.15 Adobe Acrobat Reader 10.1.16 Adobe Acrobat Reader 11.0 Adobe Acrobat Reader 11.0.0 Adobe Acrobat Reader 11.0.01 Adobe Acrobat Reader 11.0.1 Adobe Acrobat Reader 11.0.02 Adobe Acrobat Reader 11.0.2 Adobe Acrobat Reader 11.0.03 Adobe Acrobat Reader 11.0.3 Adobe Acrobat Reader 11.0.04 Adobe Acrobat Reader 11.0.4 Adobe Acrobat Reader 11.0.05 Adobe Acrobat Reader 11.0.5 Adobe Acrobat Reader 11.0.06 Adobe Acrobat Reader 11.0.6 Adobe Acrobat Reader 11.0.07 Adobe Acrobat Reader 11.0.7 Adobe Acrobat Reader 11.0.08 Adobe Acrobat Reader 11.0.8 Adobe Acrobat Reader 11.0.09 Adobe Acrobat Reader 11.0.9 Adobe Acrobat Reader 11.0.10 Adobe Acrobat Reader 11.0.11 Adobe Acrobat Reader 11.0.12 Adobe Acrobat Reader 11.0.13 Adobe Acrobat Reader 11.0.14 Adobe Acrobat Reader DC 15.006.30119 Adobe Acrobat Reader DC 15.000.0000 Adobe Acrobat Reader DC 15.008.20082 Adobe Acrobat Reader DC 15.009.20069 Adobe Acrobat Reader DC 15.009.20071 Adobe Acrobat Reader DC 15.009.20077 Adobe Acrobat Reader DC 15.009.20079 Adobe Acrobat Reader DC 15.010.20056 Adobe Acrobat Reader DC 15.010.20059	306
OS	Apple Apple MAC OS X *	1
OS	Microsoft Microsoft Windows *	1

Common Weakness Enumeration (CWE)

CWE-20 - Improper Input Validation

Common Attack Pattern Enumeration and Classification (CAPEC)

Buffer Overflow via Environment Variables
This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
Server Side Include (SSI) Injection
An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
Cross Zone Scripting
An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
Cross Site Scripting through Log Files
An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
Command Line Execution through SQL Injection
An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Nessus

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_ADOBE_ACROBAT_APSB16-09.NASL
description	The version of Adobe Acrobat installed on the remote Mac OS X host is prior to 11.0.15, 15.006.30121, or 15.010.20060. It is, therefore, affected by multiple vulnerabilities : - A memory corruption issue exists due to the use of uninitialized memory when handling annotation gestures. A remote attacker can exploit this, via a crafted PDF file, to corrupt memory, resulting in a denial of service or the execution of arbitrary code. (CVE-2016-1007) - A flaw exists related to searching and loading dynamic-link library (DLL) files due to using a search path that may contain directories which are not trusted or under the user
last seen	2020-06-01
modified	2020-06-02
plugin id	89832
published	2016-03-10
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/89832
title	Adobe Acrobat < 11.0.15 / 15.006.30121 / 15.010.20060 Multiple Vulnerabilities (APSB16-09) (Mac OS X)
code	# # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(89832); script_version("1.8"); script_cvs_date("Date: 2019/11/20"); script_cve_id("CVE-2016-1007", "CVE-2016-1008", "CVE-2016-1009"); script_bugtraq_id(84215, 84216); script_name(english:"Adobe Acrobat < 11.0.15 / 15.006.30121 / 15.010.20060 Multiple Vulnerabilities (APSB16-09) (Mac OS X)"); script_summary(english:"Checks the version of Adobe Acrobat."); script_set_attribute(attribute:"synopsis", value: "The version of Adobe Acrobat installed on the remote Mac OS X host is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Adobe Acrobat installed on the remote Mac OS X host is prior to 11.0.15, 15.006.30121, or 15.010.20060. It is, therefore, affected by multiple vulnerabilities : - A memory corruption issue exists due to the use of uninitialized memory when handling annotation gestures. A remote attacker can exploit this, via a crafted PDF file, to corrupt memory, resulting in a denial of service or the execution of arbitrary code. (CVE-2016-1007) - A flaw exists related to searching and loading dynamic-link library (DLL) files due to using a search path that may contain directories which are not trusted or under the user's control. An attacker can exploit this, by injecting a malicious DLL into the path, to gain elevated privileges. (CVE-2016-1008) - An array indexing error exists due to improper validation of user-supplied input. A remote attacker can exploit this, via a crafted PDF file, to corrupt memory, resulting in a denial of service or the execution of arbitrary code. (CVE-2016-1009) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/reader/apsb16-09.html"); script_set_attribute(attribute:"solution", value: "Upgrade to Adobe Acrobat version 11.0.15 / 15.006.30121 / 15.010.20060 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-1009"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2016/03/08"); script_set_attribute(attribute:"patch_publication_date", value:"2016/03/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/10"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("macosx_adobe_acrobat_installed.nbin"); script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version", "installed_sw/Adobe Acrobat"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("install_func.inc"); get_kb_item_or_exit("Host/local_checks_enabled"); os = get_kb_item("Host/MacOSX/Version"); if (empty_or_null(os)) audit(AUDIT_OS_NOT, "Mac OS X"); app_name = "Adobe Acrobat"; install = get_single_install(app_name:app_name); version = install['version']; path = install['path']; ver = split(version, sep:'.', keep:FALSE); for (i=0; i<max_index(ver); i++) ver[i] = int(ver[i]); # Affected is : # # 11.x < 11.0.15 # DC Classic < 15.006.30121 # DC Continuous < 15.010.20060 if ( (ver[0] == 11 && ver[1] == 0 && ver[2] <= 14) \|\| (ver[0] == 15 && ver[1] == 6 && ver[2] <= 30119) \|\| (ver[0] == 15 && ver[1] == 7 ) \|\| (ver[0] == 15 && ver[1] == 8 ) \|\| (ver[0] == 15 && ver[1] == 9 ) \|\| (ver[0] == 15 && ver[1] == 10 && ver[2] <= 20059) ) { report = '\n Path : '+path+ '\n Installed version : '+version+ '\n Fixed version : 11.0.15 / 15.006.30121 / 15.010.20060' + '\n'; security_report_v4(port:0, extra:report, severity:SECURITY_HOLE); } else audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, path);

NASL family	Windows
NASL id	ADOBE_READER_APSB16-09.NASL
description	The version of Adobe Reader installed on the remote Windows host is prior to 11.0.15, 15.006.30121, or 15.010.20060. It is, therefore, affected by multiple vulnerabilities : - A memory corruption issue exists due to the use of uninitialized memory when handling annotation gestures. A remote attacker can exploit this, via a crafted PDF file, to corrupt memory, resulting in a denial of service or the execution of arbitrary code. (CVE-2016-1007) - A flaw exists related to searching and loading dynamic-link library (DLL) files due to using a search path that may contain directories which are not trusted or under the user
last seen	2020-06-01
modified	2020-06-02
plugin id	89831
published	2016-03-10
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/89831
title	Adobe Reader < 11.0.15 / 15.006.30121 / 15.010.20060 Multiple Vulnerabilities (APSB16-09)
code	# # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(89831); script_version("1.10"); script_cvs_date("Date: 2019/11/19"); script_cve_id("CVE-2016-1007", "CVE-2016-1008", "CVE-2016-1009"); script_bugtraq_id(84215, 84216); script_name(english:"Adobe Reader < 11.0.15 / 15.006.30121 / 15.010.20060 Multiple Vulnerabilities (APSB16-09)"); script_summary(english:"Checks the version of Adobe Reader."); script_set_attribute(attribute:"synopsis", value: "The version of Adobe Reader installed on the remote Windows host is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Adobe Reader installed on the remote Windows host is prior to 11.0.15, 15.006.30121, or 15.010.20060. It is, therefore, affected by multiple vulnerabilities : - A memory corruption issue exists due to the use of uninitialized memory when handling annotation gestures. A remote attacker can exploit this, via a crafted PDF file, to corrupt memory, resulting in a denial of service or the execution of arbitrary code. (CVE-2016-1007) - A flaw exists related to searching and loading dynamic-link library (DLL) files due to using a search path that may contain directories which are not trusted or under the user's control. An attacker can exploit this, by injecting a malicious DLL into the path, to gain elevated privileges. (CVE-2016-1008) - An array indexing error exists due to improper validation of user-supplied input. A remote attacker can exploit this, via a crafted PDF file, to corrupt memory, resulting in a denial of service or the execution of arbitrary code. (CVE-2016-1009) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/acrobat/apsb16-09.html"); script_set_attribute(attribute:"solution", value: "Upgrade to Adobe Reader version 11.0.15 / 15.006.30121 / 15.010.20060 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-1009"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2016/03/08"); script_set_attribute(attribute:"patch_publication_date", value:"2016/03/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/10"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat_reader"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows"); script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("adobe_reader_installed.nasl"); script_require_keys("SMB/Registry/Enumerated", "installed_sw/Adobe Reader"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("install_func.inc"); get_kb_item_or_exit("SMB/Registry/Enumerated"); app_name = "Adobe Reader"; install = get_single_install(app_name:app_name); # NOTE: For this version of Reader, the AcroRd32.dll file was only # updated to reflect the proper version. The normal EXE was # not updated, so we have to look at the DLL. # The detection plugin will not report the proper version. version = install['DLL_Product_Version']; # DLL version - not EXE path = install['path']; verui = install['DLL_Display_Version']; ver = split(version, sep:'.', keep:FALSE); for (i=0; i<max_index(ver); i++) ver[i] = int(ver[i]); # Affected is : # # 11.x < 11.0.15 # DC Classic < 15.006.30121 # DC Continuous < 15.010.20060 if ( (ver[0] == 11 && ver[1] == 0 && ver[2] <= 14) \|\| (ver[0] == 15 && ver[1] == 6 && ver[2] <= 30119) \|\| (ver[0] == 15 && ver[1] == 7 ) \|\| (ver[0] == 15 && ver[1] == 8 ) \|\| (ver[0] == 15 && ver[1] == 9 ) \|\| (ver[0] == 15 && ver[1] == 10 && ver[2] <= 20059) ) { port = get_kb_item('SMB/transport'); if(!port) port = 445; report = '\n Note: The Adobe Reader version was extracted from AcroRd32.dll.' + '\n Path : '+path+ '\n Installed version : '+verui+ '\n Fixed version : 11.0.15 / 15.006.30121 / 15.010.20060' + '\n'; security_report_v4(port:port, extra:report, severity:SECURITY_HOLE); } else audit(AUDIT_INST_PATH_NOT_VULN, app_name, verui, path);

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_ADOBE_READER_APSB16-09.NASL
description	The version of Adobe Reader installed on the remote Mac OS X host is prior to 11.0.15, 15.006.30121, or 15.010.20060. It is, therefore, affected by multiple vulnerabilities : - A memory corruption issue exists due to the use of uninitialized memory when handling annotation gestures. A remote attacker can exploit this, via a crafted PDF file, to corrupt memory, resulting in a denial of service or the execution of arbitrary code. (CVE-2016-1007) - A flaw exists related to searching and loading dynamic-link library (DLL) files due to using a search path that may contain directories which are not trusted or under the user
last seen	2020-06-01
modified	2020-06-02
plugin id	89833
published	2016-03-10
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/89833
title	Adobe Reader < 11.0.15 / 15.006.30121 / 15.010.20060 Multiple Vulnerabilities (APSB16-09) (Mac OS X)

NASL family	Windows
NASL id	ADOBE_ACROBAT_APSB16-09.NASL
description	The version of Adobe Acrobat installed on the remote Windows host is prior to 11.0.15, 15.006.30121, or 15.010.20060. It is, therefore, affected by multiple vulnerabilities : - A memory corruption issue exists due to the use of uninitialized memory when handling annotation gestures. A remote attacker can exploit this, via a crafted PDF file, to corrupt memory, resulting in a denial of service or the execution of arbitrary code. (CVE-2016-1007) - A flaw exists related to searching and loading dynamic-link library (DLL) files due to using a search path that may contain directories which are not trusted or under the user
last seen	2020-06-01
modified	2020-06-02
plugin id	89830
published	2016-03-10
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/89830
title	Adobe Acrobat < 11.0.15 / 15.006.30121 / 15.010.20060 Multiple Vulnerabilities (APSB16-09)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

References