Adobe addressed a critical vulnerability in Adobe Creative Cloud App that allows deleting files

Adobe has addressed a critical vulnerability in its Creative Cloud desktop application that can be exploited by hackers to delete arbitrary files.

Adobe has fixed a critical vulnerability in its Creative Cloud desktop application that can be exploited by attackers to delete arbitrary files.

Creative Cloud is a collection of 20+ desktop and mobile apps and services for photography, design, video, web, UX and more. Now you can take your ideas to new places with Photoshop on the iPad, draw and paint with Fresco, and design for 3D and AR. 

“Adobe has released a security update for Adobe Creative Cloud Desktop Application for windows. This update address a critical vulnerability. Successful exploitation could lead to arbitrary File Deletion in the context of the current user.” reads the advisory published by Adobe.

The critical vulnerability, tracked as CVE-2020-3808, is a Time-of-check time-of-use (TOCTOU) race condition that was reported by jiadongLu South China University of Technology and Zhiniang Peng of Qihoo 360 Core Security (@edwardzpeng).

The priority score assigned to the flaw is 2, which means that the flaw is not easy to exploit and Adobe does not expect to observe any attacks exploiting the issue very soon.

The flaw affects the Windows version of the Creative Cloud desktop application, Adobe Creative Cloud desktop application version 5.1 addressed the vulnerability.

Adobe did not disclose technical details about the vulnerability, the good news is that the company is not aware of attacks in the wild that exploited the vulnerability.

Last week, Adobe released a set of out-of-band software updates that address a total of 41 vulnerabilities in six of its products.

The vulnerabilities affect the following products:

• Genuine Integrity Service
• Acrobat and Reader
• Photoshop
• Experience Manager
• ColdFusion
• Bridge

29 vulnerabilities out of the 41 are rated as critical in severity, the remaining 11 have been rated as important.

Pierluigi Paganini

(SecurityAffairs – Adobe, hacking)

Share On