Adobe fixes Acrobat Reader zero-day with public PoC exploit

A cybersecurity researcher is urging customers to beef up Adobe Acrobat Reader after a fix became once launched the day earlier than these days for a a long way-off code execution zero-day with a public in-the-wild proof-of-belief exploit.

The flaw is tracked as CVE-2024-41869 and is a crucial use after free vulnerability that might perchance lead to a long way-off code execution when opening a particularly crafted PDF doc.

A “use after free” malicious program is when a program tries to find entry to data in a reminiscence space that has already been freed or launched. This causes surprising behavior, equivalent to a program crashing or freezing.

Nonetheless, if a menace actor is ready to store malicious code in that reminiscence space, and the program therefore accesses it, it would be at possibility of enact malicious code on the targeted instrument.

The flaw has now been fastened in the most modern  Acrobat Reader and Adobe Acrobat versions.

Oeisdigitalinvestigator.com: PoC exploit chanced on in June

The Acrobat Reader zero-day became once chanced on in June through EXPMON, a sandbox-basically based entirely platform created by cybersecurity researcher Haifei Li to detect superior exploits equivalent to zero-days or laborious-to-detect (unknown) exploits.

“I created EXPMON because I noticed that there have been no sandbox-basically based entirely detection and evaluation programs particularly focusing on detecting threats from an exploit or vulnerability standpoint,” Li told BleepingComputer.

“Your full diversified programs originate detection from a malware standpoint. The exploit/vulnerability standpoint is a long way valuable if you’re going to prefer to pass more superior (or, early) detection.”

“Let’s say, if no malware is dropped or executed due to sure stipulations, or if the attack would no longer use any malware in any respect, these programs would omit such threats. Exploits operate pretty otherwise from malware, so a diversified system is valuable to detect them.”

The zero-day became once chanced on after a tall selection of samples from a public source have been submitted to EXPMON for evaluation. These samples incorporated a PDF containing a proof-of-belief exploit that triggered a rupture.

Whereas the PoC exploit is a work in growth and comprises no malicious payloads, it became once confirmed to take merit of a “client after free” malicious program, that will be susceptible for a long way-off code execution. 

After Li disclosed the flaw to Adobe, a security replace became once launched in August. Nonetheless, the replace did no longer fix the flaw and might perchance well silent be triggered after closing diversified dialogs.

“We tested the (precisely the a comparable) sample on the “patched” Adobe Reader version, it displayed extra dialogs, but when the patron clicked/closed these dialogs, the app silent crashed! Linked UAF malicious program!,” tweeted the EXPMON X tale.

The day earlier than these days, Adobe launched a contemporary security replace that fixes the malicious program, now tracked as CVE-2024-41869.

Li will be releasing valuable aspects on how the malicious program became once detected on EXPMON’s weblog and extra technical data in an upcoming Test Level Learn document.