CVE-2024-49511
📋 TL;DR
Adobe InDesign has an out-of-bounds read vulnerability that could allow attackers to read sensitive memory contents when a user opens a malicious file. This could help bypass security mitigations like ASLR. Users of InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected.
💻 Affected Systems
- Adobe InDesign Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Memory disclosure leading to ASLR bypass enabling more severe follow-on attacks like remote code execution
Likely Case
Information disclosure of sensitive memory contents, potentially revealing application data or system information
If Mitigated
Limited impact due to user interaction requirement and memory read-only nature
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and is an out-of-bounds read, not write
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ID19.5.1 and later for InDesign 19.x; ID18.5.4 and later for InDesign 18.x
Vendor Advisory: https://helpx.adobe.com/security/products/indesign/apsb24-88.html
Restart Required: Yes
Instructions:
1. Open Adobe Creative Cloud application 2. Navigate to 'Apps' tab 3. Find InDesign and click 'Update' 4. Restart computer after update completes
🔧 Temporary Workarounds
Restrict InDesign file execution
allConfigure application control to block execution of InDesign files from untrusted sources
User awareness training
allTrain users to only open InDesign files from trusted sources
🧯 If You Can't Patch
- Implement application whitelisting to restrict InDesign execution to trusted locations only
- Use email filtering and web gateways to block malicious InDesign file attachments
🔍 How to Verify
Check if Vulnerable:
Check InDesign version via Help > About InDesign menuCheck Version:
On Windows: Check Add/Remove Programs for Adobe InDesign version. On macOS: Check Applications folder > Adobe InDesign > Get InfoVerify Fix Applied:
Verify version is ID19.5.1 or later (for 19.x) or ID18.5.4 or later (for 18.x)📡 Detection & Monitoring
Log Indicators:
- Application crashes of InDesign with memory access violations
- Security software alerts for suspicious InDesign file execution
Network Indicators:
- Downloads of InDesign files from untrusted sources
SIEM Query:
source="*indesign*" AND (event_type="crash" OR event_type="access_violation")