Two new security vulnerabilities were revealed this week in Adobe Systems' (Profile, Products, Articles) Version Cue software, the second and third security flaws discovered in the company's software in less than two weeks, according to security consulting firm iDefense.
Both flaws allow local attackers to gain root privileges to a machine through Version Cue, the file-version manager in Adobe's Creative Suite software, according to Michael Sutton, director of iDefense Labs at iDefense.
One flaw is a "library loading vulnerability" that enables potential hackers to load a custom library by executing a method from the command line of VCNative, a root application in Version Cue, said Rich Johnson, a senior security engineer with iDefense Labs. In this way, someone could take full control of a system and gain root privileges, thus enabling them to introduce malicious code.
The other way someone could gain root privileges through Version Cue is to exploit the log file created when the root application VCNative begins running, he said. The log file is always called the same thing, and if a person "knows what it's called they could put a file in there that would allow redirection of that file to a location of choice, then can override special system files with this," Johnson said.
Adobe already has issued a patch for both vulnerabilities, which can be downloaded at http://www.adobe.com/support/security/main.html#vcuemac, he said.
Tools: Post a comment | Link to this news item | Send to a friend | Submit News
Error: You are not logged in.
In order to leave comments to news articles you must be a Cyber Tech Help Member.
Registration is completely free!
Register to become a member
Along with access to leave comments to news articles you will be able to ask any computing questions you might have on the Cyber Tech Help Forums.
