Connect with us

Plato Vertical Search

Cyber Security

Adobe Patches Reader Flaws That Earned Hackers $150,000 at Chinese Contest

Adobe on Tuesday announced security updates for several products, including for Acrobat and Reader, in which the software giant patched a total of 26 vulnerabilities.

read more

Adobe on Tuesday announced security updates for several products, including for Acrobat and Reader, in which the software giant patched a total of 26 vulnerabilities.

Of the 26 security holes fixed in the Windows and macOS versions of Acrobat and Reader, 16 have been assigned a “critical” severity rating (high severity based on their CVSS score), and a majority are memory-related issues that can be exploited for arbitrary code execution.

Four of these critical vulnerabilities — CVE-2021-44704 through CVE-2021-44707 — were disclosed by four different teams at China’s Tianfu Cup hacking contest.

Tianfu Cup organizers offered up to $60,000 for Reader exploits that achieved remote code execution with a sandbox escape. Researchers earned a total of $1.9 million at the event that took place in October.

A source told SecurityWeek that the team representing Chinese cybersecurity company Cyber Kunlun earned $60,000 for its exploit, while the other teams earned $30,000 each, as their exploits did not include a sandbox escape. The exploit worth $60,000 included a Windows kernel bug that Microsoft has yet to patch.

The remaining flaws patched in Acrobat and Reader can be exploited for privilege escalation, bypassing security features, causing a DoS condition, and obtaining data from memory.

In addition, Adobe patched two issues in Illustrator, six flaws in Bridge, four vulnerabilities in InCopy, and three vulnerabilities in InDesign.

Adobe says it’s not aware of any malicious attacks targeting these vulnerabilities.

Related: Chrome 95 Update Patches Exploited Zero-Days, Flaws Disclosed at Tianfu Cup

Related: Apple Patches Vulnerabilities That Earned Hackers $600,000 at Chinese Contest

Advertisement. Scroll to continue reading.
Adobe Patches Reader Flaws That Earned Hackers $150,000 at Chinese Contest
view counter
Adobe Patches Reader Flaws That Earned Hackers $150,000 at Chinese Contest
Adobe Patches Reader Flaws That Earned Hackers $150,000 at Chinese Contest

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:
Adobe Patches Reader Flaws That Earned Hackers $150,000 at Chinese ContestTags:

Source: https://www.securityweek.com/adobe-patches-reader-flaws-earned-hackers-150000-chinese-contest

Advertisement Buy Bitcoin at coinsmart.com
Advertisement
Advertisement

Related Streams

Gaming

Having announced its acquisition of Activision Blizzard, Microsoft says that it's reviewing its own sexual harassment and gender discrimination policies. Read this article on...

Gaming

Last week TechRaptor was lucky enough to have a chance to learn more about the upcoming Wizards of the Coast Dungeons & Dragons 5e...

Gaming

Innersloth has revealed the 2022 Among Us roadmap, and we're getting friends lists, new Cosmicube options, and lots more this year. Read this article...

Gaming

Norland is a city builder and medieval kingdom simulator that generates stories based on your noble family, religious conflict, economic issues, and battle. Read...