Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I ran a vulnerability scan against a server and it is pulling back a lot of Adobe vulnerabilities. I ran a Wireshark capture on the scan but I can't seem to write up a Wireshark filter on the packets. Does anyone know how to look for the versions of Adobe in Wireshark? (or any tool that will remotely pull the versions would be helpful).

**edited. I did say Apache in my first question. I found the Apache article and had that stuck in my head when I wrote it. I need ADOBE versions.

share|improve this question
Try sending a long request (e.g. with 4000+ 'A's) to force a HTTP 414. Almost always leaks the version through such error responses. – Polynomial May 28 '13 at 14:49
Adobe is one big vulnerability waiting to inflict itself upon you. Okay, this is partially tongue in cheek (the software is very popular and complex)... – Deer Hunter May 28 '13 at 21:40
Please also be explicit in what you mean by "Adobe". There are a bunch of very different products. – Deer Hunter May 28 '13 at 21:42
What Adobe product, and what kind of 'vulnerability scan'? – schroeder May 29 '13 at 15:55

It's EVERYWHERE... like a virus.

Adobe uses Apple's Bonjour service also known as mDNSResponder.exe to communicate with the mother ship. More about Bonjour here. Adobe transfers things like licensing, usage, and error data. They also run a service called armsvc.exe which is the Adobe Acrobat Update Service that also calls home to check for updates periodically. Adobe has a video about how to remove mDNSReponsder on their TV site.

If you're running a Creative Suite on your server (not likely, but not unheard of) you'll also get traffic from different plug-ins in various apps that connect to web services, also anything that uses the Creative Cloud will also likely transfer data and try to authenticate a license, as well as all web programs like Dreamweaver, Muse, and Flash obviously.

If this is a Windows box, you can use sysinternals process explorer to check for different running apps and the company name of the owner of the process. If it's a Mac server then you can open activity monitor to see what's running, in addition to top via command line.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.