Lucene search

K
openvasCopyright (C) 2023 Greenbone AGOPENVAS:1361412562310826970
HistoryApr 14, 2023 - 12:00 a.m.

Adobe Reader DC Continuous Security Update (APSB23-24) - Windows

2023-04-1400:00:00
Copyright (C) 2023 Greenbone AG
plugins.openvas.org
2
adobe reader dc
continuous
windows
vulnerabilities
security update
cve-2023-26417
cve-2023-26418
cve-2023-26419
cve-2023-26420
cve-2023-26422
cve-2023-26423
cve-2023-26405
cve-2023-26406
cve-2023-26407
cve-2023-26408
cve-2023-26424
cve-2023-26425
cve-2023-26421
cve-2023-26395
cve-2023-26396
cve-2023-26397
input validation
access control
integer underflow
out-of-bounds
secure design
memory leak
privilege escalation
arbitrary code
update.

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

High

0.539 Medium

EPSS

Percentile

97.6%

Adobe Acrobat Reader is prone to multiple
vulnerabilities.

# SPDX-FileCopyrightText: 2023 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:adobe:acrobat_reader_dc_continuous";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.826970");
  script_version("2023-10-12T05:05:32+0000");
  script_cve_id("CVE-2023-26417", "CVE-2023-26418", "CVE-2023-26419", "CVE-2023-26420",
                "CVE-2023-26422", "CVE-2023-26423", "CVE-2023-26405", "CVE-2023-26406",
                "CVE-2023-26407", "CVE-2023-26408", "CVE-2023-26424", "CVE-2023-26425",
                "CVE-2023-26421", "CVE-2023-26395", "CVE-2023-26396", "CVE-2023-26397");
  script_tag(name:"cvss_base", value:"7.2");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_tag(name:"last_modification", value:"2023-10-12 05:05:32 +0000 (Thu, 12 Oct 2023)");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2023-04-13 02:51:00 +0000 (Thu, 13 Apr 2023)");
  script_tag(name:"creation_date", value:"2023-04-14 15:30:20 +0530 (Fri, 14 Apr 2023)");
  script_name("Adobe Reader DC Continuous Security Update (APSB23-24) - Windows");

  script_tag(name:"summary", value:"Adobe Acrobat Reader is prone to multiple
  vulnerabilities.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present
  on the target host.");

  script_tag(name:"insight", value:"Multiple flaws are due to:

  - An improper input validation.

  - An improper access control error.

  - An integer underflow error.

  - Multiple out-of-bounds read or write errors.

  - Violation of secure design principles.

  - Multiple use after free errors.");

  script_tag(name:"impact", value:"Successful exploitation will allow attackers
  to escalate privileges, execute arbitrary code and cause memory leak on an
  affected system.");

  script_tag(name:"affected", value:"Adobe Reader DC (Continuous) versions
  23.001.20093 and earlier on Windows.");

  script_tag(name:"solution", value:"Update Adobe Reader DC (Continuous)
  to version 23.001.20143 or later.");

  script_tag(name:"solution_type", value:"VendorFix");
  script_tag(name:"qod_type", value:"registry");
  script_xref(name:"URL", value:"https://helpx.adobe.com/security/products/acrobat/apsb23-24.html");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2023 Greenbone AG");
  script_family("General");
  script_dependencies("gb_adobe_acrobat_reader_dc_cont_detect_win.nasl");
  script_mandatory_keys("Adobe/Acrobat/ReaderDC/Continuous/Win/Ver");
  exit(0);
}
include("host_details.inc");
include("version_func.inc");

if(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE)) exit(0);
vers = infos["version"];
path = infos["location"];

if(version_is_less(version:vers, test_version:"23.001.20143"))
{
  report = report_fixed_ver(installed_version:vers, fixed_version:"23.001.20143", install_path:path);
  security_message(data:report);
  exit(0);
}
exit(99);

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

High

0.539 Medium

EPSS

Percentile

97.6%