Unofficial Patch Released for Adobe Reader Zero-Day

One day before Adobe’s monthly security updates, a third-party fix has been released for an Adobe Reader vulnerability revealed several weeks ago.

Discovered by security researcher Alex Inführ, who also published proof-of-concept code, the vulnerability allows a PDF document to send SMB requests to an attacker’s server. 

The vulnerability impacts the latest version of Adobe Reader DC, 2019.010.20069, and is likely affecting older versions of the application as well. 

The security flaw is similar to CVE-2018-4993, a vulnerability disclosed in April last year, which could allow a remote attacker to steal NTLM details included in the SMB request. The attack is possible because remote documents and files can be embedded inside PDF files. 

To address the issue, Adobe added a security warning that Reader would show to the user before a request to a remote share was made. The alert allowed users to prevent a potentially malicious document from sending any type of information to the attacker’s server.

What Inführ discovered was that the alert can actually be bypassed if Universal Naming Convention (UNC) paths are employed. These paths denote resources in shared folders and are used to access remote file systems, typically SMB. 

While Adobe has yet to address the vulnerability, 0patch, a community project that aims to address software vulnerabilities by delivering tiny fixes to users worldwide, has already released a micropatch for Reader and delivered it to their users. 

The fix follows on Adobe’s footsteps by adding a warning when a PDF document uses UNC paths to load resources from a remote location. With this micropatch installed, a security alert will be displayed to the user before the document makes any request to a remote server. 

Adobe is getting ready to release its monthly set of security updates today, and is expected to address vulnerabilities in both Adobe Acrobat and Reader, but there’s no information currently available on whether this issue will receive an official fix or not. 

UPDATE. Adobe has released an official patch for this vulnerability, which it tracks as CVE-2019-7089.

Related: PDF Files Can Silently Leak NTLM Credentials

Related: Two Critical Flaws Patched in Adobe Acrobat, Reader

Related: Microsoft Incompletely Patches JET Database Vulnerability