If you need to receive SMS online, use the SIMonline.su service
The company eliminated a total of 71 vulnerabilities in Acrobat and Reader. One of them has been described as a disclosure issue that could lead to leakage of confidential data.
The error was described in detail in a blog post published at the end of January by researcher Alex Infure, who showed how it can be used in a specially created PDF document to send SMB requests to an attacker’s server when opening a file.
The vulnerability is similar to CVE-2018-4993, which Adobe fixed last year. This allows the remote attacker to steal the NTLM user hash included in the SMB request and can be used to warn the attacker when his malicious PDF was opened by the target user.
Adobe has released a security update patch. This micropatch alerts the user when a document tries to connect to a remote server, and allows him to block the connection before sending any data.
Adobe reported that it assigned this vulnerability a CVE identifier of 2019-7089. The company says it knows about the publicly available “technical documentation” for this security hole.
This is the second time Adobe fixes a vulnerability similar to CVE-2018-4993.
Other weaknesses fixed by Adobe in Acrobat and Reader include many critical errors in arbitrary code execution caused by memory corruption errors.
In Flash Player, which will receive security updates by the end of 2020, Adobe has fixed only one “important” vulnerability that could lead to information disclosure.
Two flaws - one that allows code to be executed, and an XSS error that could lead to information disclosure - have been fixed in ColdFusion. One vulnerability has also been fixed in the installer of the Creative Cloud desktop application.
Adobe says it does not know about hacks for any of the vulnerabilities that were fixed in updates released in February 2019.
