CVE-2020-9717
📋 TL;DR
This CVE describes an out-of-bounds read vulnerability in Adobe Acrobat and Reader that could allow attackers to read sensitive memory contents. Successful exploitation could lead to information disclosure, potentially exposing passwords, encryption keys, or other confidential data. Users of affected Adobe Acrobat and Reader versions are vulnerable.
💻 Affected Systems
- Adobe Acrobat DC
- Adobe Acrobat Reader DC
- Adobe Acrobat 2017
- Adobe Acrobat Reader 2017
- Adobe Acrobat 2015
- Adobe Acrobat Reader 2015
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive memory contents including passwords, encryption keys, or other confidential information, potentially leading to complete system compromise through follow-on attacks.
Likely Case
Information disclosure of memory contents, which could include document data, user credentials, or system information that could be used in subsequent attacks.
If Mitigated
Limited impact with proper network segmentation, application sandboxing, and memory protection mechanisms in place.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious PDF file. No public proof-of-concept has been disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2020.009.20075, 2020.001.30003, 2017.011.30172, 2015.006.30524
Vendor Advisory: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
Restart Required: Yes
Instructions:
1. Open Adobe Acrobat or Reader. 2. Go to Help > Check for Updates. 3. Follow the prompts to download and install the latest update. 4. Restart the application when prompted.
🔧 Temporary Workarounds
Disable JavaScript in Adobe Reader
allDisabling JavaScript can prevent exploitation of many PDF-based vulnerabilities
Edit > Preferences > JavaScript > Uncheck 'Enable Acrobat JavaScript'
Use Protected View
allEnable Protected View for files from potentially unsafe locations
Edit > Preferences > Security (Enhanced) > Enable Protected View for all files from the internet
🧯 If You Can't Patch
- Implement application whitelisting to block execution of vulnerable Adobe Reader versions
- Use network segmentation to isolate systems running vulnerable versions from critical assets
🔍 How to Verify
Check if Vulnerable:
Check Adobe Acrobat/Reader version via Help > About Adobe Acrobat/Reader and compare against affected versionsCheck Version:
On Windows: wmic product where "name like 'Adobe Acrobat%'" get versionVerify Fix Applied:
Verify version is 2020.009.20075 or later, 2020.001.30003 or later, 2017.011.30172 or later, or 2015.006.30524 or later📡 Detection & Monitoring
Log Indicators:
- Application crashes in Adobe Acrobat/Reader logs
- Security event logs showing unexpected process termination
Network Indicators:
- Unusual PDF file downloads from untrusted sources
- Outbound connections following PDF file opening
SIEM Query:
source="*acrobat*" AND (event_type="crash" OR event_type="error") AND file_extension="pdf"