CVE-2014-0568: Critical severity adobe acrobat reader notification manager vulnerability

Published Sep 17, 2014

Updated

The NtSetInformationFile system call hook feature in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via an NTFS junction attack.

Affected Software

53 affected components

Adobe Acrobat reader=10.0

Adobe Acrobat reader=10.0.1

Adobe Acrobat reader=10.0.2

Adobe Acrobat reader=10.0.3

Adobe Acrobat reader=10.1

Adobe Acrobat reader=10.1.1

Adobe Acrobat reader=10.1.2

Adobe Acrobat reader=10.1.3

Adobe Acrobat reader=10.1.4

Adobe Acrobat reader=10.1.5

Adobe Acrobat reader=10.1.6

Adobe Acrobat reader=10.1.7

Adobe Acrobat reader=10.1.8

Adobe Acrobat reader=10.1.9

Adobe Acrobat reader=10.1.10

Adobe Acrobat reader=10.1.11

Adobe Acrobat reader=11.0

Adobe Acrobat reader=11.0.1

Adobe Acrobat reader=11.0.2

Adobe Acrobat reader=11.0.3

Adobe Acrobat reader=11.0.4

Adobe Acrobat Reader Windows=11.0.5

Adobe Acrobat reader=11.0.6

Adobe Acrobat reader=11.0.7

Adobe Acrobat reader=11.0.8

Microsoft Windows

Adobe Acrobat=10.0

Adobe Acrobat=10.0.1

Adobe Acrobat=10.0.2

Adobe Acrobat=10.0.3

Adobe Acrobat=10.1

Adobe Acrobat=10.1.1

Adobe Acrobat=10.1.2

Adobe Acrobat=10.1.3

Adobe Acrobat=10.1.4

Adobe Acrobat=10.1.5

Adobe Acrobat=10.1.6

Adobe Acrobat=10.1.7

Adobe Acrobat=10.1.8

Adobe Acrobat=10.1.9

Adobe Acrobat=10.1.10

Adobe Acrobat=10.1.11

Adobe Acrobat=11.0

Adobe Acrobat=11.0.1

Adobe Acrobat=11.0.2

Adobe Acrobat=11.0.3

Adobe Acrobat=11.0.4

Adobe Acrobat Windows=11.0.5

Adobe Acrobat=11.0.6

Adobe Acrobat=11.0.7

Adobe Acrobat=11.0.8

Remediation

Patch Available

http://helpx.adobe.com/security/products/reader/apsb14-20.html

Event History

Sep 17, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-0568?

CVE-2014-0568 is rated as critical due to its ability to bypass sandbox protections and execute native code.

How do I fix CVE-2014-0568?

To fix CVE-2014-0568, update Adobe Reader and Acrobat to version 10.1.12 or 11.0.09 or later.

What software is affected by CVE-2014-0568?

CVE-2014-0568 affects Adobe Reader and Acrobat versions 10.x before 10.1.12 and 11.x before 11.0.09 on Windows.

What type of attack is associated with CVE-2014-0568?

CVE-2014-0568 is associated with an NTFS junction attack that allows attackers to bypass sandbox protections.

Can CVE-2014-0568 affect my system if I do not use Adobe products?

CVE-2014-0568 specifically affects systems running vulnerable versions of Adobe Reader and Acrobat, so it will not impact systems without these applications.