Adobe Reader Installed (Mac OS X)

#TRUSTED 02bca6346f0e9269088a916c947b18715de76264b3c56ba56c5eb06d3ab7d00190a7b187fb6e193a1dc6c77efc69e3af220bca5f30e3e2d5334bd910b2b13ccff458fdf9cb07dfd058a0b99527e168b8897363478564baeb2be77e08305e46795b5e841c3b879ceb173da901a9a325c36790f431425556c328d9f2431df9c1e6fc52711e6bcf996f9272cc5285e434dcbf1112ccca7bdc9ec89eb750de5ce9ee63c4da488733baf24b01a8d69f511aa0a769c1d02ab72d0b00e962a84c66950c54ca2cee363e6f351cb04dd4488a7cc856126b22bbeb70cff31414892963a49168cb3ed772fb4bc9e57dbb233a8db8cde7299fe62ba27bbc95e48e00c6c4a1793b43bd68a2806af4892121cf781939a5f1ba240f7fd0c386fc821d8cd2f2663e1b649f6c789202a745132fde20252dd8ce6c328bc10e7e7c9f7d618660c733ca7fe1c4604813e7d664966696e2e9fc37e80a69135d3ef7ce3ec5c70622a549806833dd525cd7a9644460ac28a1a2cfd1d62ed525a29a627d0985831d5bb59c0ebcfe51e5e364dbc64e4ff8d8e541314522be3d202508270c11695832b3d196c90354f35d5bbd5b88a641bdff363c9845f4f8ef9a9b636f1dbf2f4f15c9b453d425612fd869df3ed3b6deb7d9dbeb771686412355da788698a4aa8f1b3350cd96fab3299b6d9b550a007a513c82e8a74ab7e6eb09f7a57e2db9f97b52ac889cd6
#TRUST-RSA-SHA256 8f0eafeb515b80348bde1ca80174b05ca5d2b20677fadfbca61e083a7ca2647407bdda5ccc70c8d4f4e49fd5519ddc332f81ea7668c8e53b83cb00c04c5727b988f20d657f780fc3c51218e4091c7ce1b89e9216edfb350bf3f2662b28f868adfcb948c9c339ba0dde28fad1a793139a03785462b7828c0b5b8be2de946472acabebb6dfa8a0ee471231071369b86f2c85182667b50d5e4412d8f9e04fefd7f8877f7a98ceb8af99e959b0dc50cffcfc81462818d3e6b53a5b3268e1d469982d9bed254a61d564a8900e9e43c8771f68ed36b63ff0d647baf077edd8f457e81f1e52312469f767004613bcbd030abf9e96b286f7de1e436694558786c31477fa422c5273b8a805377d01469421dc04ff29ad7db509101600f04638ec4113b6433e211752f5b9fa9539b1b9e10fd8b0572bd732b69e52d99cd55a6e57f7c75b18456a0e4d81bc9f6807436ba69bcbecee6d952cb545fb3e69e57c4111cab810f95799ffe8aabf528d1ffe2d3c870e51978950dfc3e1044f44e4cd1926839cef144184f247f5278f53bda2c8942810cd1e7ee05cade00f445663b382ef19b2e70229d957432b2b27916ebea2ea65d6a105d54b28f5a52915635edfeae069bd28c7188d131b6092dcc3b9e177e60a33e5454a9d6e03056a513a8c801e85eb4ebc9546307721287d17cf933802246438f27e3a7810aeeb9c8c0dcb141d18a2d146aa
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(55420);
  script_version("1.40");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/21");

  script_xref(name:"IAVT", value:"0001-T-0524");

  script_name(english:"Adobe Reader Installed (Mac OS X)");
  script_summary(english:"Gets the Reader version from Info.plist.");

  script_set_attribute(attribute:"synopsis", value:
"The remote Mac OS X host contains a PDF file viewer.");
  script_set_attribute(attribute:"description", value:
"Adobe Reader, a PDF file viewer, is installed on the remote Mac OS X
host.");
  script_set_attribute(attribute:"see_also", value:"https://acrobat.adobe.com/us/en/products/pdf-reader.html");
  script_set_attribute(attribute:"solution", value:"n/a");
  script_set_attribute(attribute:"risk_factor", value:"None");

  script_set_attribute(attribute:"plugin_publication_date", value:"2011/06/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat_reader");
  script_set_attribute(attribute:"asset_inventory", value:"True");
  script_set_attribute(attribute:"asset_inventory_category", value:"software_enumeration");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2011-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl", "command_builder_init.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version");

  exit(0);
}

include("ssh_func.inc");
include("telnet_func.inc");
include("hostlevel_funcs.inc");
include("macosx_func.inc");
include("install_func.inc");
include('find_cmd.inc');
include('local_detection_nix.inc');
include('command_builder.inc');

function adobe_extract_version_track(plist)
{
  local_var result = [];

  local_var version_cmd =  'plutil -convert xml1 -o - \'' + plist + '\' | ' +
    'grep -A 1 CFBundleShortVersionString | ' +
    'tail -n 1 | ' +
    'sed \'s/.*<string>\\(.*\\)<\\/string>.*/\\1/g\'';

  result[0] = exec_cmd(cmd:version_cmd);

  local_var track_cmd =  'plutil -convert xml1 -o - \'' + plist + '\' | ' +
    'grep -A 1 TrackName | ' +
    'tail -n 1 | ' +
    'sed \'s/.*<string>\\(.*\\)<\\/string>.*/\\1/g\'';

  result[1] = exec_cmd(cmd:track_cmd);

  return result;
}

## Main ##

var app = "Adobe Reader";

enable_ssh_wrappers();

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var os = get_kb_item("Host/MacOSX/Version");
if (!os) audit(AUDIT_HOST_NOT, "Mac OS X");

var kb_base = "MacOSX/Adobe_Reader";

if (islocalhost())
{
  if (!defined_func("pread")) audit(AUDIT_FN_UNDEF,"pread");
  info_t = INFO_LOCAL;
}
else
{
  sock_g = ssh_open_connection();
  if (!sock_g) audit(AUDIT_FN_FAIL, 'ssh_open_connection');
  info_t = INFO_SSH;
}

var item, tmp, dir, base_dir, plist, timeout, result, version, track, cmd;

var adobe_path_patterns = make_list('*Adobe*Reader*.app', '*Acrobat*Reader*.app', '*Adobe*Acrobat*Reader*.app', '*Adobe*Acrobat*.app');

var dirs = find_cmd(
  path_patterns:adobe_path_patterns,
  start:'/Applications',
  timeout:240,
  maxdepth:2,
  sanitize_result:TRUE
);

if (info_t == INFO_SSH) ssh_close_connection();

if (empty_or_null(dirs)) audit(AUDIT_NOT_INST, app);
else if(dirs[0] == FIND_OK ) dirs = dirs[1];

info_connect(exit_on_fail:TRUE);

var check_reader = '/Library/Application Support/Adobe/Acrobat/DC/SupportFiles/Preferences/com.adobe.acrobat.scainstaller.plist';
var reader_content = ldnix::get_file_contents(file:check_reader);
var reader_match = pregmatch(string:reader_content, pattern:"<key>SCAPackageLevel<\/key>\s*<integer>(\d)", multiline:TRUE);

var install_count = 0;

if (reader_match[1] > 1)   # Value would be 1 if the product is Acrobat Reader
{
  audit(AUDIT_NOT_INST, app);
}

foreach dir (split(dirs, keep:FALSE))
{
  ## skip any other variant that doesn't match
  if (!pregmatch(string:dir, pattern:"(Adobe\sAcrobat\sReader*|Adobe\sReader*|Acrobat\sReader*|Adobe\sAcrobat*)"))
    audit(AUDIT_NOT_INST, app);

  # Check dir for unexpected chars
  if (!command_builder::validate_no_injection_denylist(dir))
  {
    dbg::detailed_log(lvl:1, msg:'Continue due to injection attempt in Adobe Reader install dir',
        msg_details:{
          'install dir':{'lvl':1, 'value':dir}
        }
    );
    continue;
  }

  base_dir = dir - "/Applications";

  plist = dir + "/Contents/Info-macos.plist";

  result = adobe_extract_version_track(plist:plist);
  if (empty_or_null(result[0]))
  {
    plist = dir + "/Contents/Info.plist";
    result = adobe_extract_version_track(plist:plist);
  }

  version = result[0];
  track = result[1];

  if (isnull(version) || version !~ "^[0-9]+\.") version = UNKNOWN_VER;
  if (isnull(track)) track = UNKNOWN_VER;

  set_kb_item(name:kb_base+base_dir+"/Version", value:version);
  set_kb_item(name:kb_base+base_dir+"/Track", value:track);

  register_install(
    app_name:app,
    vendor : 'Adobe',
    product : 'Acrobat Reader',
    path:dir,
    version:version,
    display_version:version,
    cpe:"cpe:/a:adobe:acrobat_reader");

  install_count += 1;
}

if (install_count)
{
  set_kb_item(name:kb_base+"/Installed", value:TRUE);
  report_installs(app_name:app, port:0);
}
else audit(AUDIT_UNKNOWN_APP_VER, app);