SB2018041014 - Privilege escalation in Adobe InDesign

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Insecure DLL loading (CVE-ID: CVE-2018-4927)

The vulnerability allows a local attacker to gain elevated privileges on vulnerable system.

The weakness exists due to insecure .dll loading mechanism when opening files. A local attacker can place a file along with specially crafted .dll file on a remote SBM or WebDAV share and execute arbitrary code on the target system with elevated privileges.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

2) Memory corruption (CVE-ID: CVE-2018-4928)

The vulnerability allows a local attacker to gain elevated privileges on vulnerable system.

The weakness exists due to boundary error. A local attacker can run a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Remediation

Install update from vendor's website.

References

• https://helpx.adobe.com/security/products/indesign/apsb18-11.html