Vulnerable version of Adobe Acrobat Reader is installed


Query · osquery

-- Vulnerable version of Adobe Acrobat Reader is installed
--
-- References:
--   * https://helpx.adobe.com/security/products/acrobat/apsb23-34.html
--
-- tags: persistent state filesystem
-- platform: darwin
SELECT
  name,
  path,
  bundle_version,
  TRIM(REGEX_MATCH (bundle_version, "^(\d+)\.", 1)) AS major,
  TRIM(REGEX_MATCH (bundle_version, "\.(\d+)$", 1)) AS patch
FROM
  apps
WHERE
  name LIKE "%Acrobat%"
  AND (
    (
      major = "23"
      AND CAST(patch AS integer) < 20285
    )
    OR (
      major = "20"
      AND CAST(patch AS integer) < 30517
    )
  )
Raw source Vulnerable version of Adobe Acrobat Reader is installed · osquery SQL
Esc
Published by chainguard-dev/osquery-defense-kit ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified.
-- Vulnerable version of Adobe Acrobat Reader is installed
--
-- References:
--   * https://helpx.adobe.com/security/products/acrobat/apsb23-34.html
--
-- tags: persistent state filesystem
-- platform: darwin
SELECT
  name,
  path,
  bundle_version,
  TRIM(REGEX_MATCH (bundle_version, "^(\d+)\.", 1)) AS major,
  TRIM(REGEX_MATCH (bundle_version, "\.(\d+)$", 1)) AS patch
FROM
  apps
WHERE
  name LIKE "%Acrobat%"
  AND (
    (
      major = "23"
      AND CAST(patch AS integer) < 20285
    )
    OR (
      major = "20"
      AND CAST(patch AS integer) < 30517
    )
  )

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.