ADE v4.5.10.186048 still triggers for APSB19-16 via Nessus Plugin 122815

[alexs41701503]

SYNOPSIS: Nessus requires complete version string information to be written to the Windows registry to ascertain if an application has a known vulnerability. The version of ADE which remediates APSB19-16 does not present full version string information, and thus vulnerability scanning tools falsely claim it is vulnerable to APSB19-16

FIX: The Adobe Digital Editions Product Team needs to release an updated installer for ADE, which correctly inserts the full version data into the registry, so that Nessus can correctly determine the version, and thus differentiate from a vulnerable or non-vulnerable version. Also note that the metadata on the DigitalEditions.exe file also claims that it is 4.5.10.0, so that should be updated as well. (Basically, if the About dialog says the version is 4.5.10.186048, don't tell other system components that the version is something different, such as 4.5.10.)

DISCUSSION:

Adobe Digital Editions v4.5.10.186048 is detected by Nessus as being vulnerable for APSB19-16, in plugin 122815. This is because ADE is not correctly updating the Windows Registry with the full version string during installation, and Nessus is relying on the information reported in the registry to be correct.

I have verified multiple times, on multiple different systems, that the version of ADE being obtained from Adobe's download page is the correct version, and the About dialog box of ADE validates that the installed version is the non-vulnerable version, of 4.5.10.186048. Additionally, Tenable--the creator of Nessus--has been engaged about this false positive detection, and they indicate that they are using industry standard locations (e.g., the Windows registry) to check for version information.

Below is the Nessus plugin code which is from plugin 122815, which indicates that the plugin is indeed checking the registry for the correct version string.

==========

---

include("vcf.inc");

get_kb_item_or_exit("SMB/Registry/Enumerated");

app_info = vcf::get_app_info(app:"Adobe Digital Editions", win_local:TRUE);

constraints = [

  { "fixed_version" : "4.5.10.186048" }

];

vcf::check_version_and_report(app_info:app_info, constraints:constraints,

severity:SECURITY_HOLE);

---

==========

From a versioning perspective, the version reported in all current metadata indicates that ADE is 4.5.10. As 4.5.10 (or 4.5.10.0) is an earlier version than 4.5.10.186048, Nessus reports that the application is vulnerable, regardless of the fact that it is not.

As a simple overview of the issue, I have attached an image below, showing that ADE is stating that it is the patched version, however the versioning information in Programs and Features is erroneously displaying 4.5.10. Consequently, any tool relying on the data presented by the Programs and Features list (or, rather, the source data of the Windows registry) will--in this specific instance, at least--get incorrect information if they take the version string as fact, and thus may deduce that a vulnerable version of the software is installed.

[christopherh14337180]

This is an old post but wanted to point out that these issues still pop-up on each release of thier product.

Thank you for the detailed issue, and hopefully they will change thier development patterns in the future.

[AN-ADOBE-USER]

Adobe just released a new version of ADE (4.5.12) and after many years, this time it is a minor version upgrade instead of a build version upgrade. They did this specifically to address the issue that asset management and vulnerability management tools were not able to correctly detect the installed version because in the past the installer was not correctly setting the required registry keys. The download page with the new build is at ADOBE DIGITAL EDITIONS Download - https://www.adobe.com/

[christopherh14337180]

I see it and thank you. I am afraid this may still continue to up in the future. While yep, happy they released a a new version, they still not correctly have the version applied to the digitaleditions.exe nor do they have the correct version on the registry uninstall key. The version is 4.5.12 in the registry and 4.5.12.0 on the .exe. The version should be be 4.5.12.112. I fully expect to get another finding in the coming days.