Adobe Security Bulletin

Release date: February 14, 2017

Vulnerability identifier: APSB17-06

Priority: 3

CVE number: CVE-2017-2968, CVE-2017-2969

Platform: Windows and Linux

Summary

Adobe has released a security update for Adobe Campaign v6.11 for Windows and Linux.  This update resolves a moderate security bypass affecting the Adobe Campaign client console.  An authenticated user with access to the client console could upload and execute a malicious file, potentially resulting in read and write access to the system (CVE-2017-2968). This update also resolves a moderate input validation issue that could be used in cross-site scripting attacks (CVE-2017-2969).

Affected versions

Solution

Adobe categorizes these updates with the following priority rating and recommends users update their installation to the newest version:

• Customers may refer to the FAQ for instructions on downloading the latest build.
• For customers with Adobe Campaign 16.4 Build 8724 and earlier, please refer to the documentation page for instructions to resolve CVE-2017-2968 by restricting uploads by file type.
• Please refer to this documentation page for assistance in upgrading Adobe Campaign server, and this documentation page for assistance in upgrading the Client Console.
  

Vulnerability Details

• This update resolves a moderate security bypass affecting Adobe Campaign that could be exploited by an authenticated user with access to the client console. Successful exploitation could lead to read and write access to the system (CVE-2017-2968).
  
• This update resolves a moderate input validation issue that could be used in cross-site scripting attacks (CVE-2017-2969).
  

Acknowledgments

Adobe would like to thank Léa NUEL of NES for reporting these issues (CVE-2017-2968 and CVE-2017-2969) and for working with Adobe to help protect our customers.