cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
caverna
Engaged Sweeper III
Hi guys, this is my suggestion to report this vulnerability described at https://helpx.adobe.com/security/products/acrobat/apsb18-09.html



Select Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.Username,
tblAssets.Userdomain,
tblAssets.IPAddress,
tblAssets.SP,
tblAssets.Lastseen,
tblAssets.Lasttried,
tblSoftwareUni.softwareName As Software,
tblSoftware.softwareVersion As Version,
tblSoftwareUni.SoftwarePublisher As Publisher,
tblSoftware.Lastchanged
From tblAssets
Inner Join tblSoftware On tblAssets.AssetID = tblSoftware.AssetID
Inner Join tblSoftwareUni On (
tblSoftwareUni.SoftID = tblSoftware.softID And (
(tblSoftwareUni.softwareName Like '%Acrobat Reader%' Or tblSoftwareUni.softwareName Like '%Acrobat%') And
tblSoftwareUni.softwareName Not Like '%Extended Asian%' And
tblSoftwareUni.softwareName Not Like '%Acrobat.com%' And
tblSoftwareUni.softwareName Not Like '%MUI%'
)
)
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Where
tblAssetCustom.State = 1 And
Convert(Int,replace (tblSoftware.softwareVersion,'.','')) <= 1801120038
Order By
tblAssets.Domain,
tblAssets.AssetName,
Software


based on: https://www.lansweeper.com/forum/yaf_postst16153_7-Zip-Arbitrary-Code-Execution-Vulnerability-Check.aspx
updated according to Sylvie suggestion!
1 ACCEPTED SOLUTION
caverna
Engaged Sweeper III
Sylvie wrote:
Hi,

Here is my report for this vulnerabilty:
  • avoid using substring and use replace instead --> legacy Adobe products taken into account
  • filter the softwarename directly within the Inner Join --> faster and avoid "Convert(Int,..." to be analysed first
  • add some exceptions to the filter : acrobat.com and %MUI% products


f*cking awsome!!!

View solution in original post

10 REPLIES 10
Esben_D
Lansweeper Employee
Lansweeper Employee
Thank you for sharing!