CVE-2021-36071:Out-of-bounds read vulnerability in Adobe Bridge versions 11.1 and earlier could lead to memory disclosure and security bypass.

splash
Back

Description Preview

Adobe Bridge versions 11.1 and earlier contain an out-of-bounds read vulnerability (CWE-125) that could allow an attacker to access arbitrary memory content. If successfully exploited, this vulnerability could lead to the disclosure of sensitive information and potentially bypass security mitigations such as Address Space Layout Randomization (ASLR). Exploitation requires user interaction, as a victim must open a malicious file crafted by the attacker.

Overview

This vulnerability (CVE-2021-36071) affects Adobe Bridge versions 11.1 and earlier. The out-of-bounds read vulnerability occurs when the application attempts to read data beyond the bounds of allocated memory, potentially exposing sensitive information. This type of vulnerability is particularly concerning because it could allow attackers to bypass Address Space Layout Randomization (ASLR), a security feature designed to make exploitation of memory corruption vulnerabilities more difficult. For successful exploitation, an attacker would need to create a specially crafted file and convince a user to open it with Adobe Bridge.

Remediation

Users should update to the latest version of Adobe Bridge as soon as possible. Adobe has released security patches to address this vulnerability in their security bulletin APSB21-69. In addition to updating, users should:

  • Exercise caution when opening files from unknown or untrusted sources
  • Implement the principle of least privilege for all user accounts
  • Consider using application sandboxing technologies where available
  • Keep all software, not just Adobe products, up to date with the latest security patches

References

  1. Adobe Security Bulletin APSB21-69: https://helpx.adobe.com/security/products/bridge/apsb21-69.html
  2. CWE-125 (Out-of-bounds Read): https://cwe.mitre.org/data/definitions/125.html
  3. Information about ASLR bypass techniques: https://www.fireeye.com/blog/threat-research/2013/10/aslr-bypass-apocalypse-in-lately-zero-day-exploits.html

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing
    Manufacturing
  2. Health Care & Social Assistance
    Health Care & Social Assistance
  3. Public Administration
    Public Administration
  4. Educational Services
    Educational Services
  5. Transportation & Warehousing
    Transportation & Warehousing
  6. Arts, Entertainment & Recreation
    Arts, Entertainment & Recreation
  7. Finance and Insurance
    Finance and Insurance
  8. Management of Companies & Enterprises
    Management of Companies & Enterprises
  9. Professional, Scientific, & Technical Services
    Professional, Scientific, & Technical Services
  10. Utilities
    Utilities
  11. Information
    Information
  12. Other Services (except Public Administration)
    Other Services (except Public Administration)
  13. Retail Trade
    Retail Trade
  14. Wholesale Trade
    Wholesale Trade
  15. Accommodation & Food Services
    Accommodation & Food Services
  16. Administrative, Support, Waste Management & Remediation Services
    Administrative, Support, Waste Management & Remediation Services
  17. Agriculture, Forestry Fishing & Hunting
    Agriculture, Forestry Fishing & Hunting
  18. Construction
    Construction
  19. Mining
    Mining
  20. Real Estate Rental & Leasing
    Real Estate Rental & Leasing

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background
Armis Vulnerability Intelligence Database