×
Why CIS Solutions Join CIS Resources
CIS WorkBench Sign-in CIS WorkBench Sign In Cloud Security CIS Cloud Security Support CIS Support


Why CIS

Who We Are

CIS is an independent, nonprofit organization with a mission to create confidence in the connected world



About Us Leadership Principles Testimonials

Solutions

secure your organization
Secure Your Organization


secure specific platforms
Secure Specific Platforms


cis securesuite CIS SecureSuite®
u s state local tribal and territorial governments
U.S. State, Local, Tribal & Territorial Governments


View All Products & Services  

Join CIS

Get Involved

Join CIS as a member, partner, or volunteer - or explore our career opportunities



CIS SecureSuite® Membership Multi-State ISAC (MS-ISAC®) Elections Infrastructure ISAC (EI-ISAC®) CIS CyberMarket® Vendors CIS Communities Careers

Resources

resources
Secure Your Organization


learn
Learn


filter by topic
Filter by Topic


View All Resources  
CIS Logo Show Search Expand Menu

Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution

MS-ISAC ADVISORY NUMBER:

2021-067

DATE(S) ISSUED:

05/11/2021

OVERVIEW:

Multiple vulnerabilities have been discovered in Adobe Products, the most severe of which could allow for arbitrary code execution.

  • Acrobat and Reader is a family of application software and Web services mainly used to create, view, and edit PDF documents.
  • Animate is a multimedia authoring computer animation program.
  • Experience Manager is a content management solution for building websites, mobile apps, and forms.
  • InCopy is a professional word processor.
  • InDesign is an industry-leading layout and page design software for print and digital media.
  • Illustrator is a vector graphics editor and design program.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

May 11 – UPDATED OVERVIEW:
Multiple vulnerabilities have been reported in Magento, Adobe Medium and Adobe After Effects, the most severe of which could allow for arbitrary code execution.

  • Magento is a leading provider of cloud commerce innovation to merchants and brands across B2C and B2B industries.
  • Medium is a digital sculpting software that works with virtual reality headsets and 6DoF motion controllers. It is used to create and paint digital sculptures.
  • After Effects is a digital visual effects, motion graphics, and compositing application.

THREAT INTELLIGENCE:

There are currently no reports of these vulnerabilities being exploited in the wild.

SYSTEMS AFFECTED:

  • Acrobat 2020 and Acrobat Reader 2020 versions prior to 2020.001.30025
  • Acrobat 2017 and Acrobat Reader 2017 versions prior to 2017.011.30196
  • Adobe Animate versions prior to 21.0.6
  • Adobe Experience Manager versions prior to 6.4.8.4 and 6.5.8.0
  • Adobe InCopy versions prior to 16.2.1
  • Adobe InDesign versions prior to 16.2.1
  • Adobe Illustrator versions prior to 25.2.3
  • Magento Commerce versions prior to 2.4.2-p1
  • Magento Commerce versions prior to 2.3.7
  • Magento Open Source versions prior to 2.4.2-p1
  • Magento Open Source versions prior to 2.3.7
  • Adobe After Effects versions prior to 18.2
  • Adobe Medium versions prior to 2.4.5.332

RISK:

Government:
  • Large and medium government entities: HIGH
  • Small government entities: MEDIUM
Businesses:
  • Large and medium business entities: HIGH
  • Small business entities: MEDIUM
Home Users:
LOW

TECHNICAL SUMMARY:

Multiple vulnerabilities have been discovered in Adobe Acrobat, Animate, Experience Manager Illustrator, InCopy, and InDesign, the most severe of which could allow for arbitrary code execution. Details of these vulnerabilities are as follows:
Adobe Acrobat and Reader

  • Out-of-bounds read error vulnerability, which could allow for memory leak. (CVE-2021-28557)
  • Out-of-bounds read error vulnerabilities, which could allow for arbitrary code execution. (CVE-2021-28555, CVE-2021-28565)
  • Out-of-bounds write error vulnerabilities, which could allow for arbitrary code execution. (CVE-2021-28564, CVE-2021-21044, CVE-2021-21038, CVE-2021-21086)

Adobe Animate

  • Use-after-free error vulnerability, which could allow for arbitrary code execution. (CVE-2021-28578).
  • Out-of-bound write error vulnerability, which could allow for arbitrary code execution. (CVE-2021-28577)
  • Out-of-bounds read error vulnerabilities, which could allow for information disclosure. (CVE-2021-28572, CVE-2021-28573, CVE-2021-28574, CVE-2021-28575, CVE-2021-28576)

Adobe Experience Manager

  • Improper access control vulnerability, which could allow for denial-of-service. (CVE-2021-21083)
  • Cross-site scripting vulnerability, which could allow for arbitrary JavaScript execution. (CVE-2021-21084)

Adobe InCopy

  • Path traversal vulnerability, which could allow for arbitrary code execution. (CVE-2021-21090)
    Adobe InDesign
  • Out-of-bounds write error vulnerability, which could allow for arbitrary code execution. (CVE-2021-21098, CVE-2021-21099, CVE-2021-21043)

Adobe Illustrator

  • Out-of-bounds write error vulnerability, which could allow for arbitrary code execution. (CVE-2021-21101)
  • Path traversal vulnerability, which could allow for arbitrary code execution. (CVE-2021-21102)
  • Memory corruption error vulnerabilities, which could allow for arbitrary code execution. (CVE-2021-21103, CVE-2021-21104, CVE-2021-21105)

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

May 11 – UPDATED TECHNICAL SUMMARY:
Multiple vulnerabilities have been discovered in Magento, Adobe Medium and Adobe Affect Effects, the most severe of which could result in arbitrary code execution. Details of these vulnerabilities are as follows:


***Magento Commerce and Magento Open Source

  • Information Disclosure, which could allow for disclosure of document root path. (CVE-2021-28566)
  • Improper Authorization, which could allow for unauthorized modification of customer data. (CVE-2021-28567)
  • Cross-site scripting (DOM-based), which could allow for arbitrary JavaScript execution in the browser. (CVE-2021-28556)
  • Improper Authorization, which could allow for unauthorized access to restricted resources. (CVE-2021-28563)
  • Violation of Secure Design Principles, which could allow for unauthorized access to restricted resources. (CVE-2021-28583)
  • Path traversal, which could allow for arbitrary file system write. (CVE-2021-28584)
  • Improper input validation, which could allow for security feature bypass. (CVE-2021-28585)


    Adobe Affect Effects
  • OS Command Injection, which could allow for arbitrary code execution. (CVE-2021-28571)


    Adobe Medium
  • Improper Input Validation, which could allow for arbitrary code execution. (CVE-2021-28580)
    **

RECOMMENDATIONS:

We recommend the following actions be taken:

  • Install the updates provided by Adobe immediately after appropriate testing.
  • Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
  • Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.
  • Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources.
  • Apply the Principle of Least Privilege to all systems and services.

REFERENCES:

Get Email Updates When Cyber Threats Like This Arise

Arrow Subscribe to Advisories

Information Hub : Advisories


CONTROL: 1 --- ADVISORY CONTROL: 0
CONTROL: 2 --- ADVISORY CONTROL: 0
CONTROL: 3 --- ADVISORY CONTROL: 0
CONTROL: 4 --- ADVISORY CONTROL: 0