Mistaken identification of Acrobat Reader DC

Vulnerability Tests
1

The script

gb_adobe_acrobat_reader_dc_cont_detect_win.nasl

incorrectly identifies a font pack as being Adobe Reader DC. This code

adobeName = registry_get_sz(key:key + item, item:"DisplayName");
adobePath = registry_get_sz(key:key + item, item:"InstallLocation");

if("Adobe Acrobat Reader DC" >< adobeName && "Acrobat Reader DC" >< adobePath)
{

Matches not only Adobe Reader DC, but also the following registry entry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall{AC76BA86-7AD7-2530-0000-AC0F074E4100}]
…
“DisplayVersion”=“15.007.20033”
…
“InstallLocation”=“C:\Program Files (x86)\Adobe\Acrobat Reader DC\”
…
“DisplayName”=“Extended Asian Language font pack for Adobe Acrobat Reader DC”

Perhaps change line 86 from

if("Adobe Acrobat Reader DC" >< adobeName && "Acrobat Reader DC" >< adobePath)

to

if("Adobe Acrobat Reader DC" = adobeName && "Acrobat Reader DC" >< adobePath)

or perhaps to

if("Adobe Acrobat Reader DC" >< adobeName && "font pack" >!< adobeName && "Acrobat Reader DC" >< adobePath)
2

Hello Karl,

Thanks for reporting, it is fixed now. Updated VT will be availble in next feed update.

Regards,
Antu

4 Likes