One day before Adobe’s monthly security updates, a third-party fix has been released for an Adobe Reader vulnerability revealed several weeks ago.
Discovered by security researcher Alex Inführ, who also published proof-of-concept code, the vulnerability allows a PDF document to send SMB requests to an attacker’s server.
The vulnerability impacts the latest version of Adobe Reader DC, 2019.010.20069, and is likely affecting older versions of the application as well.
The security flaw is similar to CVE-2018-4993, a vulnerability disclosed in April last year, which could allow a remote attacker to steal NTLM details included in the SMB request. The attack is possible because remote documents and files can be embedded inside PDF files.
To address the issue, Adobe added a security warning that Reader would show to the user before a request to a remote share was made. The alert allowed users to prevent a potentially malicious document from sending any type of information to the attacker’s server.
What Inführ discovered was that the alert can actually be bypassed if Universal Naming Convention (UNC) paths are employed. These paths denote resources in shared folders and are used to access remote file systems, typically SMB.
While Adobe has yet to address the vulnerability, 0patch, a community project that aims to address software vulnerabilities by delivering tiny fixes to users worldwide, has already released a micropatch for Reader and delivered it to their users.
The fix follows on Adobe’s footsteps by adding a warning when a PDF document uses UNC paths to load resources from a remote location. With this micropatch installed, a security alert will be displayed to the user before the document makes any request to a remote server.
Adobe is getting ready to release its monthly set of security updates today, and is expected to address vulnerabilities in both Adobe Acrobat and Reader, but there’s no information currently available on whether this issue will receive an official fix or not.
UPDATE. Adobe has released an official patch for this vulnerability, which it tracks as CVE-2019-7089.
Related: PDF Files Can Silently Leak NTLM Credentials
Related: Two Critical Flaws Patched in Adobe Acrobat, Reader
Related: Microsoft Incompletely Patches JET Database Vulnerability

More from Ionut Arghire
- Misconfigured TeslaMate Instances Put Tesla Car Owners at Risk
- Firefox 118 Patches High-Severity Vulnerabilities
- Stolen GitHub Credentials Used to Push Fake Dependabot Commits
- Google Open Sources Binary File Comparison Tool BinDiff
- UAE-Linked APT Targets Middle East Government With New ‘Deadglyph’ Backdoor
- Xenomorph Android Banking Trojan Targeting Users in US, Canada
- $200 Million in Cryptocurrency Stolen in Mixin Network Hack
- Stealthy APT Gelsemium Seen Targeting Southeast Asian Government
Latest News
- Google Rushes to Patch New Zero-Day Exploited by Spyware Vendor
- Chinese Gov Hackers Caught Hiding in Cisco Router Firmware
- CISA Unveils New HBOM Framework to Track Hardware Components
- Gem Security Lands $23 Million Series A Funding
- Misconfigured TeslaMate Instances Put Tesla Car Owners at Risk
- Firefox 118 Patches High-Severity Vulnerabilities
- Stolen GitHub Credentials Used to Push Fake Dependabot Commits
- Google Open Sources Binary File Comparison Tool BinDiff
