Rule Category

FILE-PDF -- Snort has detected suspicious traffic related to a PDF file. PDFs are easily exploitable. They include many ways to encapsulate data and are often targeted by attackers, who use the PDF's household name status for social engineering. Therefore, Snort includes Many PDF-targeted rules.

Alert Message

FILE-PDF Adobe Acrobat Reader DC Annots.api setProps use-after-free attempt

Rule Explanation

This rule alerts on an attempt to exploit CVE-2021-28550.

What To Look For

This rule alerts on an attempt to exploit CVE-2021-28550.

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

Rule Groups

No rule groups

CVE

Rule Vulnerability

Use After Free

Use After Free (UAF) attacks target computer memory flaws to corrupt the memory execute code. The name refers to attempts to use memory after it has been freed, which can cause a program to crash under normal circumstances, or result in remote code execution in a successful attack.

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.
CVE-2021-28550
Loading description

MITRE ATT&CK Framework

Tactic: Execution

Technique: User Execution

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org