CVE-2024-45107
📋 TL;DR
CVE-2024-45107 is a use-after-free vulnerability in Adobe Acrobat Reader that could allow an attacker to read sensitive memory contents and bypass ASLR protections. Users who open malicious PDF files with affected versions are vulnerable. This requires user interaction through opening a malicious file.
💻 Affected Systems
- Adobe Acrobat Reader DC
- Adobe Acrobat Reader
📦 What is this software?
Acrobat by Adobe
Acrobat by Adobe
⚠️ Risk & Real-World Impact
Worst Case
An attacker could bypass ASLR and potentially chain this with other vulnerabilities to achieve arbitrary code execution, leading to full system compromise.
Likely Case
Memory disclosure that could leak sensitive information and facilitate further exploitation by bypassing security mitigations.
If Mitigated
With proper controls, the impact is limited to potential information disclosure without code execution.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to versions after those listed in affected versions
Vendor Advisory: https://helpx.adobe.com/security/products/acrobat/apsb24-57.html
Restart Required: Yes
Instructions:
1. Open Adobe Acrobat Reader. 2. Go to Help > Check for Updates. 3. Follow prompts to install available updates. 4. Restart the application.
🔧 Temporary Workarounds
Disable JavaScript in PDFs
allPrevents JavaScript execution in PDF files which could be used in exploitation chains
In Adobe Reader: Edit > Preferences > JavaScript > Uncheck 'Enable Acrobat JavaScript'
Use Protected View
allOpen untrusted PDFs in Protected View mode to limit potential damage
Files from untrusted sources will automatically open in Protected View if configured
🧯 If You Can't Patch
- Restrict PDF file opening to trusted sources only
- Implement application whitelisting to prevent unauthorized PDF readers
🔍 How to Verify
Check if Vulnerable:
Check Adobe Reader version against affected versions listCheck Version:
In Adobe Reader: Help > About Adobe Acrobat Reader DCVerify Fix Applied:
Verify version is updated beyond affected versions📡 Detection & Monitoring
Log Indicators:
- Unexpected crashes of Adobe Reader
- Multiple failed PDF parsing attempts
Network Indicators:
- Downloads of PDF files from untrusted sources
SIEM Query:
source="*adobe*" AND (event_type="crash" OR file_type="pdf")