Adobe Security Bulletin

Adobe has released a security update for Adobe Connect.  This update resolves an important authentication bypass vulnerability (CVE-2018-4994), which could result in sensitive information disclosure if successfully exploited.  This update also resolves an important session management vulnerability due to inadequate validation of Connect meeting session tokens.  Finally, the Connect add-in installer prior to 9.7 insecurely loads DLL files, which could be abused to escalate local privileges. 

Affected product versions

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:

Note: As previously mentioned in APSB18-18, a mitigation for CVE-2018-4994 is available to customers by modifying Tomcat filters to prevent remote access to system configuration files.  Please refer to this help document for details. Version 9.8.1 includes this configuration change in default configurations. 

Vulnerability details

Note: CVE-2018-12805 was resolved in the Connect add-in installer version 9.7.  

Acknowledgments

Adobe would like to thank the following individuals and organizations for reporting the relevant issues and for working with Adobe to help protect our customers:

• Tanner LLC (CVE-2018-4994) 

• BlackWingCat (CVE-2018-12805)