CVE-2014-0568

2014-09-1710:55:00

NVD-CWE-noinfo

[email protected]

web.nvd.nist.gov

cve

2014

0568

adobe reader

acrobat

ntfs

junction attack

sandbox bypass

6.7 Medium

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.013 Low

EPSS

Percentile

85.9%

JSON

The NtSetInformationFile system call hook feature in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via an NTFS junction attack.

CPENameOperatorVersion
adobe:acrobat_readeradobe acrobat readereq10.0
adobe:acrobat_readeradobe acrobat readereq10.0.1
adobe:acrobat_readeradobe acrobat readereq10.0.2
adobe:acrobat_readeradobe acrobat readereq10.0.3
adobe:acrobat_readeradobe acrobat readereq10.1
adobe:acrobat_readeradobe acrobat readereq10.1.1
adobe:acrobat_readeradobe acrobat readereq10.1.2
adobe:acrobat_readeradobe acrobat readereq10.1.3
adobe:acrobat_readeradobe acrobat readereq10.1.4
adobe:acrobat_readeradobe acrobat readereq10.1.5

CPE	Name	Operator	Version
adobe:acrobat_reader	adobe acrobat reader	eq	10.0
adobe:acrobat_reader	adobe acrobat reader	eq	10.0.1
adobe:acrobat_reader	adobe acrobat reader	eq	10.0.2
adobe:acrobat_reader	adobe acrobat reader	eq	10.0.3
adobe:acrobat_reader	adobe acrobat reader	eq	10.1
adobe:acrobat_reader	adobe acrobat reader	eq	10.1.1
adobe:acrobat_reader	adobe acrobat reader	eq	10.1.2
adobe:acrobat_reader	adobe acrobat reader	eq	10.1.3
adobe:acrobat_reader	adobe acrobat reader	eq	10.1.4
adobe:acrobat_reader	adobe acrobat reader	eq	10.1.5