Information disclosure in Adobe Acrobat and Reader



Published: 2018-11-13
Severity Low
Patch available YES
Number of vulnerabilities 1
CVE ID CVE-2018-15979
CWE ID CWE-200
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
Subscribe
Adobe Acrobat DC
Client/Desktop applications / Office applications

Adobe Acrobat Reader DC
Client/Desktop applications / Office applications

Vendor Adobe

Security Advisory

This security advisory describes one low risk vulnerability.

1) NTLM SSO hash theft

Severity: Low

CVSSv3: 3.9 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-15979

CWE-ID: CWE-200 - Information Exposure

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to NTLM SSO hash theft. A remote attacker can trick the victim into opening a specially crafted .pdf file and gain access to potentially sensitive information.

Mitigation

Update the affected software to versions 2019.008.20081, 2017.011.30106, 2015.006.30457.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.012.20098, 2019.008.20071, 2019.008.20080

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.012.20098, 2019.008.20071, 2019.008.20080

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb18-40.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.