Detections
Analytics

Adobe Reader < 2015.006.30527 / 2017.011.30175 / 2020.001.30005 / 2020.012.20041 Multiple Vulnerabilities (APSB20-48)

high Nessus Plugin ID 139581

Language:

Synopsis

The version of Adobe Reader installed on the remote Windows host is affected by multiple vulnerabilities.

Description

The version of Adobe Reader installed on the remote Windows host is a version prior to 2015.006.30527, 2017.011.30175, 2020.001.30005, or 2020.012.20041. It is, therefore, affected by multiple vulnerabilities.

 - Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a disclosure of sensitive data vulnerability. Successful exploitation could lead to memory leak. (CVE-2020-9697)

 - Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a security bypass vulnerability. Successful exploitation could lead to privilege escalation . (CVE-2020-9714)

 - Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution . (CVE-2020-9693, CVE-2020-9694)

 - Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a security bypass vulnerability. Successful exploitation could lead to security feature bypass. (CVE-2020-9696, CVE-2020-9712)

 - Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a stack exhaustion vulnerability. Successful exploitation could lead to application denial-of-service. (CVE-2020-9702, CVE-2020-9703)

 - Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure. (CVE-2020-9705, CVE-2020-9706, CVE-2020-9707, CVE-2020-9710, CVE-2020-9716, CVE-2020-9717, CVE-2020-9718, CVE-2020-9719, CVE-2020-9720, CVE-2020-9721, CVE-2020-9723)

 - Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution . (CVE-2020-9698, CVE-2020-9699, CVE-2020-9700, CVE-2020-9701, CVE-2020-9704)

 - Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution . (CVE-2020-9715, CVE-2020-9722)

 - Memory corruption potentially leading to Arbitrary Code Execution (CVE-2020-9695, CVE-2020-9713)

 - Memory corruption potentially leading to Information disclosure (CVE-2020-9711)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Adobe Reader version 2015.006.30527 / 2017.011.30175 / 2020.001.30005 / 2020.012.20041 or later.

See Also

https://helpx.adobe.com/security/products/acrobat/apsb20-48.html

Plugin Details

Severity: High

ID: 139581

File Name: adobe_reader_apsb20-48.nasl

Version: 1.6

Type: local

Agent: windows

Family: Windows

Published: 8/14/2020

Updated: 9/12/2024

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.0

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2020-9722

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.5

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:adobe:acrobat_reader

Required KB Items: SMB/Registry/Enumerated, installed_sw/Adobe Reader

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/11/2020

Vulnerability Publication Date: 8/11/2020

Reference Information

CVE: CVE-2020-9693, CVE-2020-9694, CVE-2020-9695, CVE-2020-9696, CVE-2020-9697, CVE-2020-9698, CVE-2020-9699, CVE-2020-9700, CVE-2020-9701, CVE-2020-9702, CVE-2020-9703, CVE-2020-9704, CVE-2020-9705, CVE-2020-9706, CVE-2020-9707, CVE-2020-9710, CVE-2020-9711, CVE-2020-9712, CVE-2020-9713, CVE-2020-9714, CVE-2020-9715, CVE-2020-9716, CVE-2020-9717, CVE-2020-9718, CVE-2020-9719, CVE-2020-9720, CVE-2020-9721, CVE-2020-9722, CVE-2020-9723

IAVA: 2020-A-0363-S