Vulnerabilities > CVE-2017-3012 - Uncontrolled Search Path Element vulnerability in Adobe products

CVSS 9.3 - CRITICAL

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

network

critical

nessus

NVD

Published: 2017-04-12

Updated: 2019-10-03

Summary

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an insecure library loading (DLL hijacking) vulnerability in the OCR plugin.

Vulnerable Configurations

Part	Description	Count
Application	Adobe Adobe Acrobat - Adobe Acrobat 1.0 Adobe Acrobat 2.0 Adobe Acrobat 3.0 Adobe Acrobat 3.1 Adobe Acrobat 4.0 Adobe Acrobat 4.0.5 Adobe Acrobat 4.0.5A Adobe Acrobat 4.0.5C Adobe Acrobat 5.0 Adobe Acrobat 5.0.5 Adobe Acrobat 5.0.6 Adobe Acrobat 5.0.10 Adobe Acrobat 5.1 Adobe Acrobat 6.0 Adobe Acrobat 6.0.1 Adobe Acrobat 6.0.2 Adobe Acrobat 6.0.3 Adobe Acrobat 6.0.4 Adobe Acrobat 6.0.5 Adobe Acrobat 6.0.6 Adobe Acrobat 7 Adobe Acrobat 7.0 Adobe Acrobat 7.0.1 Adobe Acrobat 7.0.2 Adobe Acrobat 7.0.3 Adobe Acrobat 7.0.4 Adobe Acrobat 7.0.5 Adobe Acrobat 7.0.6 Adobe Acrobat 7.0.7 Adobe Acrobat 7.0.8 Adobe Acrobat 7.0.9 Adobe Acrobat 7.1.0 Adobe Acrobat 7.1.1 Adobe Acrobat 7.1.2 Adobe Acrobat 7.1.3 Adobe Acrobat 7.1.4 Adobe Acrobat 8 Adobe Acrobat 8.0 Adobe Acrobat 8.0.0 Adobe Acrobat 8.1 Adobe Acrobat 8.1.1 Adobe Acrobat 8.1.2 Adobe Acrobat 8.1.3 Adobe Acrobat 8.1.4 Adobe Acrobat 8.1.5 Adobe Acrobat 8.1.6 Adobe Acrobat 8.1.7 Adobe Acrobat 8.2 Adobe Acrobat 8.2.1 Adobe Acrobat 8.2.2 Adobe Acrobat 8.2.3 Adobe Acrobat 8.2.4 Adobe Acrobat 8.2.5 Adobe Acrobat 8.2.6 Adobe Acrobat 8.3 Adobe Acrobat 8.3.1 Adobe Acrobat 9 Adobe Acrobat 9.0 Adobe Acrobat 9.1 Adobe Acrobat 9.1.1 Adobe Acrobat 9.1.2 Adobe Acrobat 9.1.3 Adobe Acrobat 9.2 Adobe Acrobat 9.3 Adobe Acrobat 9.3.1 Adobe Acrobat 9.3.2 Adobe Acrobat 9.3.3 Adobe Acrobat 9.3.4 Adobe Acrobat 9.4 Adobe Acrobat 9.4.1 Adobe Acrobat 9.4.2 Adobe Acrobat 9.4.3 Adobe Acrobat 9.4.4 Adobe Acrobat 9.4.5 Adobe Acrobat 9.4.6 Adobe Acrobat 9.4.7 Adobe Acrobat 9.5 Adobe Acrobat 9.5.1 Adobe Acrobat 9.5.2 Adobe Acrobat 9.5.3 Adobe Acrobat 9.5.4 Adobe Acrobat 9.5.5 Adobe Acrobat 10.0 Adobe Acrobat 10.0.1 Adobe Acrobat 10.0.2 Adobe Acrobat 10.0.3 Adobe Acrobat 10.1 Adobe Acrobat 10.1.0 Adobe Acrobat 10.1.1 Adobe Acrobat 10.1.2 Adobe Acrobat 10.1.3 Adobe Acrobat 10.1.4 Adobe Acrobat 10.1.5 Adobe Acrobat 10.1.6 Adobe Acrobat 10.1.7 Adobe Acrobat 10.1.8 Adobe Acrobat 10.1.9 Adobe Acrobat 10.1.10 Adobe Acrobat 10.1.11 Adobe Acrobat 10.1.12 Adobe Acrobat 10.1.13 Adobe Acrobat 10.1.14 Adobe Acrobat 10.1.15 Adobe Acrobat 10.1.16 Adobe Acrobat 11.0 Adobe Acrobat 11.0.0 Adobe Acrobat 11.0.1 Adobe Acrobat 11.0.2 Adobe Acrobat 11.0.3 Adobe Acrobat 11.0.4 Adobe Acrobat 11.0.5 Adobe Acrobat 11.0.6 Adobe Acrobat 11.0.7 Adobe Acrobat 11.0.8 Adobe Acrobat 11.0.9 Adobe Acrobat 11.0.10 Adobe Acrobat 11.0.11 Adobe Acrobat 11.0.12 Adobe Acrobat 11.0.13 Adobe Acrobat 11.0.14 Adobe Acrobat 11.0.15 Adobe Acrobat 11.0.16 Adobe Acrobat 11.0.17 Adobe Acrobat 11.0.18 Adobe Acrobat 11.0.19 Adobe Acrobat _Reader9.5.3 Adobe Acrobat DC 15.000.0000 Adobe Acrobat DC 15.006.30033 Adobe Acrobat DC 15.006.30060 Adobe Acrobat DC 15.006.30094 Adobe Acrobat DC 15.006.30096 Adobe Acrobat DC 15.006.30097 Adobe Acrobat DC 15.006.30119 Adobe Acrobat DC 15.006.30121 Adobe Acrobat DC 15.006.30172 Adobe Acrobat DC 15.006.30173 Adobe Acrobat DC 15.006.30174 Adobe Acrobat DC 15.006.30198 Adobe Acrobat DC 15.006.30201 Adobe Acrobat DC 15.006.30243 Adobe Acrobat DC 15.006.30244 Adobe Acrobat DC 15.006.30279 Adobe Acrobat DC 15.006.30280 Adobe Acrobat DC 15.008.20082 Adobe Acrobat DC 15.009.20069 Adobe Acrobat DC 15.009.20071 Adobe Acrobat DC 15.009.20077 Adobe Acrobat DC 15.009.20079 Adobe Acrobat DC 15.010.20056 Adobe Acrobat DC 15.010.20059 Adobe Acrobat DC 15.010.20060 Adobe Acrobat DC 15.016.20039 Adobe Acrobat DC 15.016.20041 Adobe Acrobat DC 15.016.20045 Adobe Acrobat DC 15.017.20050 Adobe Acrobat DC 15.017.20053 Adobe Acrobat DC 15.020.20039 Adobe Acrobat DC 15.020.20042 Adobe Acrobat DC 15.023.20053 Adobe Acrobat DC 15.023.20056 Adobe Acrobat DC 15.023.20070 Adobe Acrobat Reader DC - Adobe Acrobat Reader DC 15.000.0000 Adobe Acrobat Reader DC 15.006.30033 Adobe Acrobat Reader DC 15.006.30060 Adobe Acrobat Reader DC 15.006.30094 Adobe Acrobat Reader DC 15.006.30096 Adobe Acrobat Reader DC 15.006.30097 Adobe Acrobat Reader DC 15.006.30119 Adobe Acrobat Reader DC 15.006.30121 Adobe Acrobat Reader DC 15.006.30172 Adobe Acrobat Reader DC 15.006.30173 Adobe Acrobat Reader DC 15.006.30174 Adobe Acrobat Reader DC 15.006.30198 Adobe Acrobat Reader DC 15.006.30201 Adobe Acrobat Reader DC 15.006.30243 Adobe Acrobat Reader DC 15.006.30244 Adobe Acrobat Reader DC 15.006.30279 Adobe Acrobat Reader DC 15.006.30280 Adobe Acrobat Reader DC 15.008.20082 Adobe Acrobat Reader DC 15.009.20069 Adobe Acrobat Reader DC 15.009.20071 Adobe Acrobat Reader DC 15.009.20077 Adobe Acrobat Reader DC 15.009.20079 Adobe Acrobat Reader DC 15.010.20056 Adobe Acrobat Reader DC 15.010.20059 Adobe Acrobat Reader DC 15.010.20060 Adobe Acrobat Reader DC 15.016.20039 Adobe Acrobat Reader DC 15.016.20041 Adobe Acrobat Reader DC 15.016.20045 Adobe Acrobat Reader DC 15.017.20050 Adobe Acrobat Reader DC 15.017.20053 Adobe Acrobat Reader DC 15.020.20039 Adobe Acrobat Reader DC 15.020.20042 Adobe Acrobat Reader DC 15.023.20053 Adobe Acrobat Reader DC 15.023.20056 Adobe Acrobat Reader DC 15.023.20070 Adobe Reader 7 Adobe Reader 8 Adobe Reader 9 Adobe Reader 11.0.0 Adobe Reader 11.0.01 Adobe Reader 11.0.02 Adobe Reader 11.0.03 Adobe Reader 11.0.04 Adobe Reader 11.0.05 Adobe Reader 11.0.06 Adobe Reader 11.0.07 Adobe Reader 11.0.08 Adobe Reader 11.0.09 Adobe Reader 11.0.10 Adobe Reader 11.0.11 Adobe Reader 11.0.12 Adobe Reader 11.0.13 Adobe Reader 11.0.14 Adobe Reader 11.0.15 Adobe Reader 11.0.16 Adobe Reader 11.0.17 Adobe Reader 11.0.18 Adobe Reader 11.0.19	259
OS	Apple Apple MAC OS X *	1
OS	Microsoft Microsoft Windows *	1

Common Weakness Enumeration (CWE)

CWE-427 - Uncontrolled Search Path Element

Common Attack Pattern Enumeration and Classification (CAPEC)

Leveraging/Manipulating Configuration File Search Paths
This attack loads a malicious resource into a program's standard path used to bootstrap and/or provide contextual information for a program like a path variable or classpath. J2EE applications and other component based applications that are built from multiple binaries can have very long list of dependencies to execute. If one of these libraries and/or references is controllable by the attacker then application controls can be circumvented by the attacker. A standard UNIX path looks similar to this If the attacker modifies the path variable to point to a locale that includes malicious resources then the user unwittingly can execute commands on the attackers' behalf: This is a form of usurping control of the program and the attack can be done on the classpath, database resources, or any other resources built from compound parts. At runtime detection and blocking of this attack is nearly impossible, because the configuration allows execution.
DLL Search Order Hijacking
The attacker exploits the functionality of the Windows DLL loader where the process loading the DLL searches for the DLL to be loaded first in the same directory in which the process binary resides and then in other directories (e.g., System32). Exploitation of this preferential search order can allow an attacker to make the loading process load the attackers' rogue DLL rather than the legitimate DLL. For instance, an attacker with access to the file system may place a malicious ntshrui.dll in the C:\Windows directory. This DLL normally resides in the System32 folder. Process explorer.exe which also resides in C:\Windows, upon trying to load the ntshrui.dll from the System32 folder will actually load the DLL supplied by the attacker simply because of the preferential search order. Since the attacker has placed its malicious ntshrui.dll in the same directory as the loading explorer.exe process, the DLL supplied by the attacker will be found first and thus loaded in lieu of the legitimate DLL. Since explorer.exe is loaded during the boot cycle, the attackers' malware is guaranteed to execute. This attack can be leveraged with many different DLLs and with many different loading processes. No forensic trails are left in the system's registry or file system that an incorrect DLL had been loaded.

Nessus

NASL family	Windows
NASL id	ADOBE_READER_APSB17-11.NASL
description	The version of Adobe Reader installed on the remote Windows host is a version prior to 11.0.20, 2015.006.30306, or 2017.009.20044. It is, therefore, affected by multiple vulnerabilities : - Multiple use-after-free errors exist that allow an attacker to execute arbitrary code. (CVE-2017-3014, CVE-2017-3026, CVE-2017-3027, CVE-2017-3035, CVE-2017-3047, CVE-2017-3057) - Multiple heap buffer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3042, CVE-2017-3048, CVE-2017-3049, CVE-2017-3055) - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2017-3015, CVE-2017-3017, CVE-2017-3018, CVE-2017-3019, CVE-2017-3023, CVE-2017-3024, CVE-2017-3025, CVE-2017-3028, CVE-2017-3030, CVE-2017-3036, CVE-2017-3037, CVE-2017-3038, CVE-2017-3039, CVE-2017-3040, CVE-2017-3041, CVE-2017-3044, CVE-2017-3050, CVE-2017-3051, CVE-2017-3054, CVE-2017-3056, CVE-2017-3065) - Multiple integer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3011, CVE-2017-3034) - Multiple memory corruption issues exist that allow an an attacker to disclose memory address information. (CVE-2017-3020, CVE-2017-3021, CVE-2017-3022, CVE-2017-3029, CVE-2017-3031, CVE-2017-3032, CVE-2017-3033, CVE-2017-3043, CVE-2017-3045, CVE-2017-3046, CVE-2017-3052, CVE-2017-3053) - A flaw exists due to the use of an insecure directory search path. An attacker can potentially exploit this to execute arbitrary code. (CVE-2017-3012, CVE-2017-3013) Note that Nessus has not tested for these issues but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	99374
published	2017-04-14
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99374
title	Adobe Reader < 11.0.20 / 2015.006.30306 / 2017.009.20044 Multiple Vulnerabilities (APSB17-11)
code	# # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(99374); script_version("1.12"); script_cvs_date("Date: 2019/11/13"); script_cve_id( "CVE-2017-3011", "CVE-2017-3012", "CVE-2017-3013", "CVE-2017-3014", "CVE-2017-3015", "CVE-2017-3017", "CVE-2017-3018", "CVE-2017-3019", "CVE-2017-3020", "CVE-2017-3021", "CVE-2017-3022", "CVE-2017-3023", "CVE-2017-3024", "CVE-2017-3025", "CVE-2017-3026", "CVE-2017-3027", "CVE-2017-3028", "CVE-2017-3029", "CVE-2017-3030", "CVE-2017-3031", "CVE-2017-3032", "CVE-2017-3033", "CVE-2017-3034", "CVE-2017-3035", "CVE-2017-3036", "CVE-2017-3037", "CVE-2017-3038", "CVE-2017-3039", "CVE-2017-3040", "CVE-2017-3041", "CVE-2017-3042", "CVE-2017-3043", "CVE-2017-3044", "CVE-2017-3045", "CVE-2017-3046", "CVE-2017-3047", "CVE-2017-3048", "CVE-2017-3049", "CVE-2017-3050", "CVE-2017-3051", "CVE-2017-3052", "CVE-2017-3053", "CVE-2017-3054", "CVE-2017-3055", "CVE-2017-3056", "CVE-2017-3057", "CVE-2017-3065" ); script_bugtraq_id( 97547, 97548, 97549, 97550, 97554, 97556 ); script_name(english:"Adobe Reader < 11.0.20 / 2015.006.30306 / 2017.009.20044 Multiple Vulnerabilities (APSB17-11)"); script_summary(english:"Checks the version of Adobe Reader."); script_set_attribute(attribute:"synopsis", value: "The version of Adobe Reader installed on the remote Windows host is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Adobe Reader installed on the remote Windows host is a version prior to 11.0.20, 2015.006.30306, or 2017.009.20044. It is, therefore, affected by multiple vulnerabilities : - Multiple use-after-free errors exist that allow an attacker to execute arbitrary code. (CVE-2017-3014, CVE-2017-3026, CVE-2017-3027, CVE-2017-3035, CVE-2017-3047, CVE-2017-3057) - Multiple heap buffer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3042, CVE-2017-3048, CVE-2017-3049, CVE-2017-3055) - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2017-3015, CVE-2017-3017, CVE-2017-3018, CVE-2017-3019, CVE-2017-3023, CVE-2017-3024, CVE-2017-3025, CVE-2017-3028, CVE-2017-3030, CVE-2017-3036, CVE-2017-3037, CVE-2017-3038, CVE-2017-3039, CVE-2017-3040, CVE-2017-3041, CVE-2017-3044, CVE-2017-3050, CVE-2017-3051, CVE-2017-3054, CVE-2017-3056, CVE-2017-3065) - Multiple integer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3011, CVE-2017-3034) - Multiple memory corruption issues exist that allow an an attacker to disclose memory address information. (CVE-2017-3020, CVE-2017-3021, CVE-2017-3022, CVE-2017-3029, CVE-2017-3031, CVE-2017-3032, CVE-2017-3033, CVE-2017-3043, CVE-2017-3045, CVE-2017-3046, CVE-2017-3052, CVE-2017-3053) - A flaw exists due to the use of an insecure directory search path. An attacker can potentially exploit this to execute arbitrary code. (CVE-2017-3012, CVE-2017-3013) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/acrobat/apsb17-11.html"); script_set_attribute(attribute:"solution", value: "Upgrade to Adobe Reader 11.0.20 / 2015.006.30306 / 2017.009.20044 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-3037"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/06"); script_set_attribute(attribute:"patch_publication_date", value:"2017/04/06"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/04/14"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat_reader"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows"); script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("adobe_reader_installed.nasl"); script_require_keys("SMB/Registry/Enumerated", "installed_sw/Adobe Reader"); exit(0); } include("vcf.inc"); include("vcf_extras.inc"); get_kb_item_or_exit("SMB/Registry/Enumerated"); app_info = vcf::adobe_reader::get_app_info(); constraints = [ { "min_version" : "11.0", "max_version" : "11.0.19", "fixed_version" : "11.0.20" }, { "min_version" : "15.6", "max_version" : "15.6.30280", "fixed_version" : "15.6.30306" }, { "min_version" : "15.7", "max_version" : "15.23.20070", "fixed_version" : "17.9.20044" } ]; # using adobe_reader namespace check_version_and_report to properly detect Continuous vs Classic, # and limit ver segments to 3 (18.x.y vs 18.x.y.12345) with max_segs:3 vcf::adobe_reader::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE, max_segs:3);

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_ADOBE_READER_APSB17-11.NASL
description	The version of Adobe Reader installed on the remote macOS or Mac OS X host is a version prior to 11.0.20, 2015.006.30306, 2017.009.20044. It is, therefore, affected by multiple vulnerabilities : - Multiple use-after-free errors exists that allow an attacker to execute arbitrary code. (CVE-2017-3014, CVE-2017-3026, CVE-2017-3027, CVE-2017-3035, CVE-2017-3047, CVE-2017-3057) - Multiple heap buffer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3042, CVE-2017-3048, CVE-2017-3049, CVE-2017-3055) - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2017-3015, CVE-2017-3017, CVE-2017-3018, CVE-2017-3019, CVE-2017-3023, CVE-2017-3024, CVE-2017-3025, CVE-2017-3028, CVE-2017-3030, CVE-2017-3036, CVE-2017-3037, CVE-2017-3038, CVE-2017-3039, CVE-2017-3040, CVE-2017-3041, CVE-2017-3044, CVE-2017-3050, CVE-2017-3051, CVE-2017-3054, CVE-2017-3056, CVE-2017-3065) - Multiple integer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3011, CVE-2017-3034) - Multiple memory corruption issues exist that allow an an attacker to disclose memory address information. (CVE-2017-3020, CVE-2017-3021, CVE-2017-3022, CVE-2017-3029, CVE-2017-3031, CVE-2017-3032, CVE-2017-3033, CVE-2017-3043, CVE-2017-3045, CVE-2017-3046, CVE-2017-3052, CVE-2017-3053) - A flaw exists due the use of an insecure directory search path. An attacker can potentially exploit this to execute arbitrary code. (CVE-2017-3012, CVE-2017-3013) Note that Nessus has not tested for these issues but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	99376
published	2017-04-14
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99376
title	Adobe Reader < 11.0.20 / 2015.006.30306 / 2017.009.20044 Multiple Vulnerabilities (APSB17-11) (macOS)

NASL family	Windows
NASL id	ADOBE_ACROBAT_APSB17-11.NASL
description	The version of Adobe Acrobat installed on the remote Windows host is a version prior to 11.0.20, 2015.006.30306, or 2017.009.20044. It is, therefore, affected by multiple vulnerabilities : - Multiple use-after-free errors exists that allow an attacker to execute arbitrary code. (CVE-2017-3014, CVE-2017-3026, CVE-2017-3027, CVE-2017-3035, CVE-2017-3047, CVE-2017-3057) - Multiple heap buffer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3042, CVE-2017-3048, CVE-2017-3049, CVE-2017-3055) - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2017-3015, CVE-2017-3017, CVE-2017-3018, CVE-2017-3019, CVE-2017-3023, CVE-2017-3024, CVE-2017-3025, CVE-2017-3028, CVE-2017-3030, CVE-2017-3036, CVE-2017-3037, CVE-2017-3038, CVE-2017-3039, CVE-2017-3040, CVE-2017-3041, CVE-2017-3044, CVE-2017-3050, CVE-2017-3051, CVE-2017-3054, CVE-2017-3056, CVE-2017-3065) - Multiple integer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3011, CVE-2017-3034) - Multiple memory corruption issues exist that allow an an attacker to disclose memory address information. (CVE-2017-3020, CVE-2017-3021, CVE-2017-3022, CVE-2017-3029, CVE-2017-3031, CVE-2017-3032, CVE-2017-3033, CVE-2017-3043, CVE-2017-3045, CVE-2017-3046, CVE-2017-3052, CVE-2017-3053) - A flaw exists due the use of an insecure directory search path. An attacker can potentially exploit this to execute arbitrary code. (CVE-2017-3012, CVE-2017-3013) Note that Nessus has not tested for these issues but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	99373
published	2017-04-14
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99373
title	Adobe Acrobat < 11.0.20 / 2015.006.30306 / 2017.009.20044 Multiple Vulnerabilities (APSB17-11)

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_ADOBE_ACROBAT_APSB17-11.NASL
description	The version of Adobe Acrobat installed on the remote macOS or Mac OS X host is a version prior to 11.0.20, 2015.006.30306, 2017.009.20044. It is, therefore, affected by multiple vulnerabilities : - Multiple use-after-free errors exists that allow an attacker to execute arbitrary code. (CVE-2017-3014, CVE-2017-3026, CVE-2017-3027, CVE-2017-3035, CVE-2017-3047, CVE-2017-3057) - Multiple heap buffer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3042, CVE-2017-3048, CVE-2017-3049, CVE-2017-3055) - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2017-3015, CVE-2017-3017, CVE-2017-3018, CVE-2017-3019, CVE-2017-3023, CVE-2017-3024, CVE-2017-3025, CVE-2017-3028, CVE-2017-3030, CVE-2017-3036, CVE-2017-3037, CVE-2017-3038, CVE-2017-3039, CVE-2017-3040, CVE-2017-3041, CVE-2017-3044, CVE-2017-3050, CVE-2017-3051, CVE-2017-3054, CVE-2017-3056, CVE-2017-3065) - Multiple integer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3011, CVE-2017-3034) - Multiple memory corruption issues exist that allow an an attacker to disclose memory address information. (CVE-2017-3020, CVE-2017-3021, CVE-2017-3022, CVE-2017-3029, CVE-2017-3031, CVE-2017-3032, CVE-2017-3033, CVE-2017-3043, CVE-2017-3045, CVE-2017-3046, CVE-2017-3052, CVE-2017-3053) - A flaw exists due the use of an insecure directory search path. An attacker can potentially exploit this to execute arbitrary code. (CVE-2017-3012, CVE-2017-3013) Note that Nessus has not tested for these issues but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	99375
published	2017-04-14
reporter	This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/99375
title	Adobe Acrobat < 11.0.20 / 2015.006.30306 / 2017.009.20044 Multiple Vulnerabilities (APSB17-11) (macOS)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

References