Adobe Bridge CC 9.0.2 on Windows/macOS information disclosure

Summaryinfo

A vulnerability, which was classified as critical, has been found in Adobe Bridge CC 9.0.2 on Windows/macOS. Impacted is an unknown function. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2019-7137. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Adobe Bridge CC 9.0.2 on Windows/macOS and classified as critical. This issue affects an unknown functionality. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Adobe Bridge CC versions 9.0.2 have a memory corruption vulnerability. Successful exploitation could lead to information disclosure.

The bug was discovered 04/09/2019. The weakness was disclosed 05/23/2019 as APSB19-25 as confirmed security bulletin (Website). The advisory is shared at helpx.adobe.com. The identification of this vulnerability is CVE-2019-7137 since 01/28/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 44 days. During that time the estimated underground price was around $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 209477 (Adobe Bridge 9.0.2 < 9.0.3 Multiple Vulnerabilities (APSB19-25)), which helps to determine the existence of the flaw in a target environment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371736 (Adobe Security Update For Bridge CC (APSB19-25)).

Upgrading to version 9.0.3 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (209477). The entries VDB-135432, VDB-135431, VDB-135433 and VDB-135434 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Image Processing Software

Vendor

• Adobe

Name

• Bridge CC

Version

• 9.0.2

License

• commercial

Website

• Vendor: https://www.adobe.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion