Tuesday, December 6, 2011

Adobe Warns of Acrobat & Reader 0-Day Vulnerability Under Attack on Windows

Adobe PDFCareful with those PDF files, folks.

Adobe has issued a security advisory for zero day vulnerability within Adobe Reader X (10.1.1), along with earlier versions for Windows and Macs, Adobe Reader 9.4.6 and earlier 9.x versions for Unix and Adobe Acrobat X (10.1.1) and earlier versions for Windows & Macs.

According to Adobe, the problem lies within an exploitable U3D memory corruption vulnerability that could cause a crash and potentially allow an attacker to take control of the compromised system.

Although the vulnerability affects multiple versions of Adobe Reader and Acrobat on numerous platforms, reports indicate that the flaw is only being actively exploited in limited, targeted attacks against Windows machines running Adobe Reader 9.x.

Adobe plans on releasing an out-of-cycle fix for Adobe Reader and Acrobat 9.x for Windows no later than sometime next week (the week of December 12, 2011) since these are the versions being actively targeted by attackers.

Patches for Adobe Reader X and Acrobat X for Windows and Mac, along with earlier versions for Mac and Adobe Reader 9.x for UNIX, will be released in the next quarterly update scheduled for Adobe Acrobat and Reader, which is January 10th, 2012.

In a corresponding blog post, Brad Arkin of the Adobe Secure Software Engineering Team (ASSET) urges users running Adobe Reader or Acrobat 9.x to upgrade to Adobe Reader X or Acrobat X.
“We put a tremendous amount of work into securing Adobe Reader and Acrobat X, and, to date, there has not been a single piece of malware identified that is effective against a version X install. Help us help you by running the latest version of the software!”

According to Adobe, Adobe Reader X Protected Mode and Adobe Acrobat X Protected View prevent an exploit of this kind from executing.

Don’t forget to follow us on Twitter at @hyphenet or “Like” us on Facebook to stay up-to-date on the latest tech news & PC security threats.

No comments:

Post a Comment