CVE-2020-29075
📋 TL;DR
This vulnerability in Adobe Acrobat Reader DC allows attackers to trigger DNS queries when users open PDF files from their local filesystem, enabling tracking of document access without user consent. The attacker can determine if a user has opened or closed a specific PDF file. Affected users include anyone running vulnerable versions of Acrobat Reader DC on Windows, macOS, or Linux systems.
💻 Affected Systems
- Adobe Acrobat Reader DC
📦 What is this software?
Acrobat by Adobe
Acrobat by Adobe
⚠️ Risk & Real-World Impact
Worst Case
An attacker could track which specific PDF documents a user opens and closes, potentially revealing sensitive information about user activities, document access patterns, or organizational workflows.
Likely Case
Targeted tracking of document access for specific users, potentially used in spear-phishing campaigns or corporate espionage to monitor document consumption patterns.
If Mitigated
Limited to tracking only that a PDF was opened/closed, not the content of the document, with no code execution or data exfiltration capabilities.
🎯 Exploit Status
Requires user to open a specially crafted PDF file. Exploitation is straightforward once malicious PDF is delivered to target.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2020.013.20074, 2020.001.30018, 2017.011.30188
Vendor Advisory: https://helpx.adobe.com/security/products/acrobat/apsb20-75.html
Restart Required: Yes
Instructions:
1. Open Adobe Acrobat Reader DC
2. Go to Help > Check for Updates
3. Follow prompts to install available updates
4. Restart the application when prompted
🔧 Temporary Workarounds
Disable automatic opening of PDFs
allConfigure system to not automatically open PDF files and require explicit user action
Use web browser PDF viewers
allConfigure PDF files to open in web browser viewers instead of Acrobat Reader
🧯 If You Can't Patch
- Implement network monitoring for suspicious DNS queries from Acrobat Reader processes
- Educate users to only open PDFs from trusted sources and avoid opening unexpected attachments
🔍 How to Verify
Check if Vulnerable:
Check Help > About Adobe Acrobat Reader DC and compare version against affected rangesCheck Version:
On Windows: "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /? | findstr /i versionVerify Fix Applied:
Verify version is 2020.013.20074 or higher, 2020.001.30018 or higher, or 2017.011.30188 or higher📡 Detection & Monitoring
Log Indicators:
- DNS queries from Acrobat Reader process to unexpected domains when opening local PDF files
Network Indicators:
- DNS requests from Acrobat Reader to attacker-controlled domains when PDF files are opened
SIEM Query:
process_name:"AcroRd32.exe" AND network_direction:outbound AND protocol:DNS