CVE-2011-0562 in Acrobat Reader
Summary
by MITRE
Untrusted search path vulnerability in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, a different vulnerability than CVE-2011-0570 and CVE-2011-0588.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2021
This vulnerability represents a classic untrusted search path issue that affects Adobe Reader and Acrobat versions prior to specific patch releases. The flaw resides in how these applications handle dynamic link library loading on Windows systems, specifically when searching for required components in the current working directory. When an application loads DLLs without explicitly specifying full paths, it follows a predefined search order that includes the current working directory, potentially allowing malicious actors to place rogue DLL files that will be loaded in place of legitimate system components. This vulnerability operates under the Common Weakness Enumeration category CWE-427, which specifically addresses uncontrolled search path dependencies, and aligns with ATT&CK technique T1546.008 related to DLL side-loading attacks.
The operational impact of this vulnerability enables local attackers to escalate privileges through a Trojan horse approach where they place a malicious DLL in the same directory as a targeted Adobe application. When the application executes and attempts to load a required library, it inadvertently loads the attacker-controlled DLL instead of the legitimate one, potentially executing arbitrary code with the privileges of the target application. This represents a significant security risk because Adobe Reader and Acrobat are frequently used applications that often run with elevated privileges, especially when processing documents from untrusted sources. The vulnerability is particularly concerning because it does not require network access or user interaction beyond placing the malicious file, making it a straightforward privilege escalation vector.
The technical implementation of this attack relies on the Windows DLL loading mechanism and the application's failure to properly validate library sources. Adobe Reader and Acrobat applications typically load various DLLs for functionality such as font rendering, plugin support, and multimedia handling, and when these libraries are not explicitly loaded from system directories, they become vulnerable to this type of attack. The vulnerability affects multiple major versions including 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6, indicating it was a widespread issue affecting the entire product line. Organizations should implement immediate mitigations including applying the vendor patches, implementing application whitelisting policies, and monitoring for suspicious DLL loading activities in system directories. Additionally, security teams should review and harden the search paths used by applications through proper configuration management and regular security assessments to prevent similar vulnerabilities from being exploited in other software components.