STIGQter: STIG Summary: Adobe Acrobat Professional DC Continuous Track Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Jul 2021:

Adobe Acrobat Pro DC Continuous periodic downloading of Adobe European certificates must be disabled.

DISA Rule

SV-213126r766535_rule

Vulnerability Number

V-213126

Group Title

SRG-APP-000427

Rule Version

AADC-CN-000990

Severity

CAT III

CCI(s)

• CCI-002470 - Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.

Weight

10

Fix Recommendation

Configure the following registry value:

Note: The Key Name "cEUTLDownload" is not created by default in the Acrobat Pro DC install and must be created.

Registry Hive:
HKEY_CURRENT_USER
Registry Path:
\Software\Adobe\Adobe Acrobat\DC\Security\cDigSig\cEUTLDownload

Value Name: bLoadSettingsFromURL
Type: REG_DWORD
Value: 0

Configure the policy value for User Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Trust Manager > 'Load trusted certificates from an Adobe EUTL server' to 'Disabled'.

Check Contents

Verify the following registry configuration:

Note: The Key Name "cEUTLDownload" is not created by default in the Acrobat Pro DC install and must be created.

Using the Registry Editor, navigate to the following: HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\DC\Security\cDigSig\cEUTLDownload

Value Name: bLoadSettingsFromURL
Type: REG_DWORD
Value: 0

If the value for bLoadSettingsFromURL is not set to “0” and Type is not configured to REG_DWORD or does not exist, this is a finding.

GUI path: Edit > Preferences > Trust Manager > In the 'Automatic European Union Trusted Lists (EUTL) updates' section > Verify the 'Load trusted certificates from an Adobe EUTL server' is not checked. If the box is checked, this is a finding.

Admin Template path: User Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Trust Manager > 'Load trusted certificates from an Adobe EUTL server' must be set to 'Disabled'.

Vulnerability Number

V-213126

Documentable

False

Rule Version

AADC-CN-000990

Severity Override Guidance

Verify the following registry configuration:

Note: The Key Name "cEUTLDownload" is not created by default in the Acrobat Pro DC install and must be created.

Using the Registry Editor, navigate to the following: HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\DC\Security\cDigSig\cEUTLDownload

Value Name: bLoadSettingsFromURL
Type: REG_DWORD
Value: 0

If the value for bLoadSettingsFromURL is not set to “0” and Type is not configured to REG_DWORD or does not exist, this is a finding.

GUI path: Edit > Preferences > Trust Manager > In the 'Automatic European Union Trusted Lists (EUTL) updates' section > Verify the 'Load trusted certificates from an Adobe EUTL server' is not checked. If the box is checked, this is a finding.

Admin Template path: User Configuration > Administrative Templates > Adobe Acrobat Pro DC Continuous > Preferences > Trust Manager > 'Load trusted certificates from an Adobe EUTL server' must be set to 'Disabled'.

Check Content Reference

M

Target Key

3973