Core Security finds critical Adobe Reader hole

(Credit: Adobe)

Updated 10:50 a.m. PT with Adobe releasing update and link.

A critical security hole in Adobe Reader could allow an attacker to take control of a computer, according to Core Security Technologies.

The vulnerability affects version 8.1.2 of Reader, Core Security said in a statement issued on Tuesday to coincide with Adobe's planned release of a security update to fix the vulnerability.

The security bulletin was posted early on Tuesday. "Adobe is not aware of any reports of these issues being exploited in the wild," the company wrote in a security blog posting.

An attacker could put malicious code in JavaScript embedded in a PDF and spread that via a Web site or e-mail, Core Security said. Once the file is opened, the code could manipulate the program's memory allocation pattern and trigger the vulnerability to execute arbitrary code with the privileges of the user.

Damian Frizza, a CoreLabs researcher, discovered the vulnerability in May while he was investigating a similar vulnerability in a different PDF viewer application called Foxit Reader. Core Security immediately reported the new hole to Adobe.

The complexity of desktop software increases the chances of applications having bugs that result from the implementation of the software, said Ivan Arce, chief technology officer of Core Security.

"We've seen similar vulnerabilities in JavaScript engines in Adobe software in the past and in other applications," he said. "It's difficult to avoid implementation bugs like this one."

The fact that both PDF Readers have the same bug indicates that even though vendors are building products with different technologies and code bases, they ought to check for such bugs in their applications when rival software is found to be vulnerable, Arce said.

[gsmiller88]

I'm so glad Apple Preview can read PDF files and I have no need for such garbage as Adobe Reader.

[kkohnen]

And I'm happy for you too! But, why does _EVERYTHING_ have to become an Apple vs. Microsoft discussion?

[rapier1]

Because if its not put in the starkest black and white many people won't be able to form an opinion of any sort. If its not 'us versus them' some people just feel lost.

[fdunn3]

to: kkohnen

What does Adobe Acrobat Reader have to do with Microsoft?

I don't see where gsmiller88 referred to MS anywhere in his post.

[GhostAlph]

to fdunn3:

You don't see what gsmiller88 was getting at because you are apparently blind to implication and inference.

Here - let me paraphrase it for you:

"I'm so glad (software for Apple platform) can (do task in question) and I have no need for such garbage as (program for Microsoft platform)."

I agree with rapier1 - if it's not "us vs. them" people generally don't care or don't get it.

[ittesi259]

Um that wasn't an Apple/MS discussion it was Preview/Acrobat Reader.....

[Heebee Jeebies]

No this was a dumb @ss to dumb @ass discussion. The Mac since moving to Intel processors has had nearly as many patch updates as Windows. Neither platform is perfect and the only reason the Mac twits spew their poo is to make themselves feel better about spending a whole lot more money for a system no better than a $600 PC and because they are locked in to the whims of Apple and have to replace the entire computer in order to upgrade because Apple won't let you update just the motherboard or processor. Someone has to make the Mac losers feel better about their choice and so I guess that falls to the suckers themselves.

Robert

[Canberra-photographer]

Apple Preview is a terrible reader for PDF files and it's likely no more secure given it still decodes PDFs.

[elezhbeth32]

A critical security hole in Adobe Reader could allow an attacker to take control of a computer, according to Core Security Technologies.

The vulnerability affects version 8.1.2 of Reader, Core Security said in a statement issued on Tuesday to coincide with Adobe's planned release of a security update to fix the vulnerability.

An attacker could put malicious code in JavaScript embedded in a PDF and spread that via a Web site or e-mail. Once the file is opened, the code could manipulate the program's memory allocation pattern and trigger the vulnerability to execute arbitrary code with the privileges of the user.

Damian Frizza, a CoreLabs researcher, discovered the vulnerability in May while he was investigating a similar vulnerability in a different PDF viewer application called Foxit Reader. Core Security immediately reported the new hole to Adobe.

Adobe representatives did not return a call seeking comment on Monday.

The complexity of desktop software increases the chances of applications having bugs that result from the implementation of the software, said Ivan Arce, chief technology officer of Core Security.

"We've seen similar vulnerabilities in JavaScript engines in Adobe software in the past and in other applications," he said. "It's difficult to avoid implementation bugs like this one."

[CoreSecurity]

Here's a link to the actual Core Security vulnerability advisory on the CoreLabs homepage: http://www.coresecurity.com/content/adobe-reader-buffer-overflow .

[rcrusoe]

foxitsoftware.com offers a free pdf reader that may not have the same problems. At the very least this 2.5 mb program launches in less than 1/10 the time of Acrobat on my computer.

[mbenedict]

@gsmiller88:

Apple's PDF implementation is also rife with security holes, so MacOS users have the privilege of all Adobe vulnerabilities PLUS all Apple vulnerabilities.

For a recent example, see CVE-2008-2322 (just patched a couple of months ago.)

Another example was MOAB-06-01-2007. Adobe promptly fixed this hole in their Reader 8.0, but OS X's Preview was vulnerable for **MONTHS** before Apple finally provided a patch.

For a security perspective, duplicate functionality means reduced defense depth, twice the attack surface, and you get worst of both worlds.

[fdunn3]

To: GhostAlph
I understood perfectly what he was implying but apparently I'm not the only blind person here as Adobe also makes the Acrobat Reader for the Mac. Also for anybody to guess that the implication was against Microsoft as he indicates in his post and you defend is just plain "paranoid", "MS Fanboy", or both. Is it that you have just never heard of Linux?

[americas234]

i already installed adobe reader 9 .is it safe from this promblem.?