CVE-2024-49549
📋 TL;DR
Adobe InDesign has an out-of-bounds read vulnerability that could allow an attacker to read sensitive memory contents and potentially bypass ASLR protections. This affects users of InDesign Desktop versions ID19.5, ID18.5.4 and earlier who open malicious files. The vulnerability requires user interaction through opening a crafted document.
💻 Affected Systems
- Adobe InDesign Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Memory disclosure could lead to ASLR bypass, enabling more sophisticated attacks like remote code execution through chained exploits.
Likely Case
Information disclosure of memory contents, potentially revealing sensitive data or system information.
If Mitigated
Limited impact with proper file handling policies and user awareness training.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and knowledge of memory layout for effective ASLR bypass.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ID19.5.1 and ID18.5.5
Vendor Advisory: https://helpx.adobe.com/security/products/indesign/apsb24-97.html
Restart Required: Yes
Instructions:
1. Open Adobe InDesign. 2. Go to Help > Updates. 3. Install available updates. 4. Restart InDesign. Alternatively, download updates from Adobe's website.
🔧 Temporary Workarounds
Restrict file opening
allConfigure policies to prevent opening untrusted InDesign files
User awareness training
allTrain users to only open InDesign files from trusted sources
🧯 If You Can't Patch
- Implement application whitelisting to restrict InDesign execution
- Use email filtering to block suspicious InDesign attachments
🔍 How to Verify
Check if Vulnerable:
Check InDesign version via Help > About InDesign. If version is ID19.5 or earlier, or ID18.5.4 or earlier, system is vulnerable.Check Version:
On Windows: Check via Control Panel > Programs. On macOS: Check via About This Mac > System Report > Applications.Verify Fix Applied:
Verify version is ID19.5.1 or later, or ID18.5.5 or later after applying updates.📡 Detection & Monitoring
Log Indicators:
- Unexpected InDesign crashes
- Large memory reads in process monitoring
Network Indicators:
- Downloads of InDesign files from untrusted sources
SIEM Query:
EventID=4688 AND ProcessName='indesign.exe' AND CommandLine CONTAINS '.indd' OR '.indt'