Adobe Reader 및 Acrobat 샌드박스 우회 및 원격 코드 실행 취약점 (CVE-2014-0546)

# Adobe Reader 설치 버전 확인 및 업데이트 서비스 트리거
$adobePath = Get-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' | 
    Where-Object { $_.DisplayName -like '*Adobe Acrobat*' -or $_.DisplayName -like '*Adobe Reader*' }

if ($adobePath) {
    Write-Host 'Detected Adobe Product:' $adobePath.DisplayName 'Version:' $adobePath.DisplayVersion
    # Adobe ARM(Acrobat Update Service) 강제 실행
    if (Test-Path 'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Adobearm.exe') {
        Start-Process 'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Adobearm.exe' -ArgumentList '/searchnow' -Wait
        Write-Host 'Update check initiated successfully.'
    } else {
        Write-Host 'Adobe Update Service executable not found. Manual update required.'
    }
} else {
    Write-Host 'No Adobe Acrobat/Reader installation detected.'
}

Windows Registry Editor Version 5.00

; Adobe Reader 11.0에 대한 보호 모드 강제 활성화
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown]
"bProtectedMode"=dword:00000001
"bEnhancedSecurityStandalone"=dword:00000001
"bEnhancedSecurityInBrowser"=dword:00000001

# 취약한 Adobe Reader 버전 점검 스크립트
$targetVersions = @('10.', '11.')
$installedApps = Get-ItemProperty -Path 'HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue

foreach ($app in $installedApps) {
    if ($app.DisplayName -like '*Adobe Reader*' -or $app.DisplayName -like '*Adobe Acrobat*') {
        $version = $app.DisplayVersion
        Write-Host 'Checking:' $app.DisplayName ' (Version: ' $version ')'
        
        if ($version -like '10.*' -and [System.Version]$version -lt [System.Version]'10.1.11') {
            Write-Warning '[VULNERABLE] Adobe 10.x version detected! Please upgrade to 10.1.11 or higher.'
        } elseif ($version -like '11.*' -and [System.Version]$version -lt [System.Version]'11.0.08') {
            Write-Warning '[VULNERABLE] Adobe 11.x version detected! Please upgrade to 11.0.08 or higher.'
        } else {
            Write-Host '[SAFE] Version is not affected or already patched.' -ForegroundColor Green
        }
    }
}