Detections
Analytics
Adobe Photoshop < CS5 / CS5.1 Multiple Arbitrary Code Execution Vulnerabilities (APSB12-11)
high Nessus Plugin ID 59172
Language:
Synopsis
The remote host has an application installed that is affected by multiple arbitrary code execution vulnerabilities.Description
The version of Adobe Photoshop installed on the remote Windows host is prior to CS5 (12.0.5) or CS5.1 (12.1.1). It is, therefore, multiple arbitrary code execution vulnerabilities :- Multiple heap-based buffer overflow conditions exist due to a failure to properly sanitize user-supplied input when decompressing and handling TIFF image files. An unauthenticated, remote attacker can exploit these issues, by convincing a user to open a specially crafted TIFF image file, to execute arbitrary code.
(CVE-2012-2027, CVE-2012-2028)
- A buffer overflow condition exists in the U3D.8bi plugin due to a failure to properly sanitize user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to open a file containing a specially crafted Collada (.dae) asset element, to execute arbitrary code. (CVE-2012-2052)
- A heap-based buffer overflow condition exists in photoshop.exe due to a failure to properly sanitize user-supplied input when decompressing a SGI24LogLum compressed TIFF image. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted TIFF image file, to execute arbitrary code. (CVE-2012-0275)
Solution
Upgrade to Adobe Photoshop CS6 (13.0). Alternatively, apply the patch referenced in the vendor advisory.See Also
http://www.nessus.org/u?268de05d
https://www.adobe.com/support/security/bulletins/apsb12-11.html
https://helpx.adobe.com/photoshop/kb/security-update-photoshop.html
Plugin Details
Severity: High
ID: 59172
File Name: adobe_photoshop_apsb12-11.nasl
Version: 1.15
Type: local
Agent: windows
Family: Windows
Published: 5/17/2012
Updated: 12/4/2019
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2012-0275
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:adobe:photoshop
Required KB Items: SMB/Adobe_Photoshop/Installed
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/8/2012
Vulnerability Publication Date: 3/20/2012
Reference Information
CVE: CVE-2012-0275, CVE-2012-2027, CVE-2012-2028, CVE-2012-2052