A cybersecurity researcher is urging customers to improve Adobe Acrobat Reader after a repair was launched yesterday for a distant code execution zero-day with a public in-the-wild proof-of-concept exploit.
The flaw is tracked as CVE-2024-41869 and is a essential use after free vulnerability that might result in distant code execution when opening a specifically crafted PDF doc.
A “use after free” bug is when a program tries to entry knowledge in a reminiscence location that has already been freed or launched. This causes sudden habits, resembling a program crashing or freezing.
Nevertheless, if a risk actor is ready to retailer malicious code in that reminiscence location, and this system subsequently accesses it, it may very well be used to execute malicious code on the focused machine.
The flaw has now been fastened within the newest Acrobat Reader and Adobe Acrobat variations.
PoC exploit found in June
The Acrobat Reader zero-day was found in June via EXPMON, a sandbox-based platform created by cybersecurity researcher Haifei Li to detect superior exploits resembling zero-days or hard-to-detect (unknown) exploits.
“I created EXPMON as a result of I seen that there have been no sandbox-based detection and evaluation programs particularly specializing in detecting threats from an exploit or vulnerability perspective,” Li advised BleepingComputer.
“All the opposite programs do detection from a malware perspective. The exploit/vulnerability perspective is far wanted if you wish to go extra superior (or, early) detection.”
“For instance, if no malware is dropped or executed because of sure situations, or if the assault doesn’t use any malware in any respect, these programs would miss such threats. Exploits function fairly in another way from malware, so a unique method is required to detect them.”
The zero-day was found after a lot of samples from a public supply have been submitted to EXPMON for evaluation. These samples included a malicious PDF containing a proof-of-concept exploit that triggered a crash.
Whereas the PoC exploit is a piece in progress and comprises no malicious payloads, it was confirmed to use a “consumer after free” bug, which may very well be used for distant code execution.
After Li disclosed the flaw to Adobe, a safety replace was launched in August. Nevertheless, the replace didn’t repair the flaw and will nonetheless be triggered after closing varied dialogs.
“We examined the (precisely the identical) pattern on the “patched” Adobe Reader model, it displayed extra dialogs, but when the consumer clicked/closed these dialogs, the app nonetheless crashed! Similar UAF bug!,” tweeted the EXPMON X account.
Yesterday, Adobe launched a new safety replace that fixes the bug, now tracked as CVE-2024-41869.
Li can be releasing particulars on how the bug was detected on EXPMON’s weblog and additional technical info in an upcoming Test Level Analysis report.