A security researcher shows that it’s possible to launch an attack internally from one PDF onto another already existing PDF. More information here.
A security researcher shows that it’s possible to launch an attack internally from one PDF onto another already existing PDF. More information here.
The critical-severity Adobe Acrobat and Reader vulnerabilities could enable arbitrary code execution and are part of a 14-CVE patch update.
The out-of-band patches follow a lighter-than-usual Patch Tuesday update earlier this month.
Adobe says the two critical flaws (CVE-2020-24407 and CVE-2020-24400) could allow arbitrary code execution as well as read or write access to the database.
Anonymous on
So the definition of a worm is malicious code that propogates without user interaction. While this is a cool parlor trick -- it does require user interaction making the trick not useful for a worm.
One additional thing that is not entirely clear in this demo is if you need to already know the name of the target PDF files. If you do, this again rules out this being used in a worm.
Although this does have some other great uses.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
AhmetBarkuş on
Teşekkürler,şu,anda,kısaca,iyi,günler,diyorum,diger,durumlar,içinse,kısmet
AhmetBarkuş