CVE-2015-6723

Vulnerability

The ANTrustPropagateAll method in Adobe Reader and Acrobat contains a flaw that allows attackers to bypass JavaScript API execution restrictions. This vulnerability affects Adobe Reader and Acrobat 10.x before 10.1.16, 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X [1]. The issue is triggered when a specially crafted PDF with specific JavaScript instructions is processed.

Exploitation

Exploitation requires user interaction: the target must open a malicious PDF file or visit a page that loads such a file. An attacker can craft a PDF containing JavaScript that calls the ANTrustPropagateAll method in a way that bypasses the intended API restrictions [1]. No authentication or special network position is needed beyond delivering the file to the victim.

Impact

Successful exploitation allows an attacker to execute arbitrary code within the context of the affected Adobe Reader or Acrobat process. This can lead to full compromise of the user's system, including reading, writing, and modifying files, installing malware, or performing other actions with the privileges of the logged-on user [1]. The CVSS score is 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) [1].

Mitigation

Adobe released fixes in the following versions: 10.1.16, 11.0.13, DC Classic 2015.006.30094, and DC Continuous 2015.009.20069 [1]. Users should update to these or later versions. No workarounds are documented; the only mitigation is applying the vendor-supplied patch.