Adobe warns of critical, unpatched security flaw
Update at 8:45 a.m. PST: Information from security firm Symantec added.
Attackers are making the rounds and exploiting a critical security flaw in Adobe Reader 9 and Acrobat 9.
Earlier versions of the PDF-related software are also affected by the critical security flaw, which could cause the applications to crash and potentially let an attacker gain control of a person's computer, Adobe Systems warned Thursday.
Reports also surfaced that attackers have developed an exploit and are taking advantage of the flaw, the company said.
Adobe has yet to develop an update to address the vulnerability but noted it expects to have one ready for Adobe Reader 9 and Acrobat 9 by March 11. After that, the company expects to launch updates for the earlier versions of the software going back to Adobe Reader 7 and Acrobat 7.
Until then, Adobe advises, people should update their virus definitions and exercise caution when opening documents from unknown sources.
Security company McAfee noted in a blog that the current attacks appear to be targeted ones but that it expects new variants of the exploit to make the rounds as more information becomes public.
In its posting, McAfee said that malicious PDF documents began to surface at the start of the year, exploiting a vulnerability in Adobe Reader versions 8 and 9. The attackers can then take advantage of a bug in Reader to overwrite memory at gain control of executing code. After that, attackers can install a Trojan horse and from there add a proverbial backdoor to a person's computer to remotely control and monitor the infected system.
Symantec, meanwhile, reports seeing the exploit used against only a few government agencies and large corporations, and within those organizations, only a few people are targeted, said Kevin Haley, a Symantec Security Response director.
"We've seen it used in only a few small places, so it tells us it's a targeted attack and someone is not trying to use it in a widespread way," Haley said, noting fewer than 100 people have been affected since it noticed the attacks on February 12.
But he added it seems likely other attackers may try to exploit the Adobe vulnerabilities and that the range of exploits may grow beyond the malware that Symantec calls Trojan.Pidief.E.
In its blog on Trojan.Pidief.E, Symantec advices users to consider disabling JavaScript in Adobe Reader and has provided instructions in a blog on a different issue.
Dawn Kawamoto covers enterprise security and financial news relating to technology for CNET News. E-mail Dawn. 
It could be a platform independant one however since Adobe's products are on a wide range of products and do require admin rights to install on most- possibly becoming a vector in and of itself.
We just don't have enough information and Adobe won't be exactly eager to share.
http://www.macworld.com/article/138943/2009/02/adobe_vulnerability.html?lsrc=rss_main
Yeah, it looks like even Mac's are vulnerable to this. It's an exploit of Adobe (Reader/Acrobat specifically) and affects ALL platforms. Of course the question still stands as to what is out there "in the wild" currently - is it smart enough to download the right trojan for the platform, or does the trojan itself work on all platforms or is this currently used to attack only one platform?
Mac users have options, Apple's Preview app handles pdf files pretty decently. I'm pretty sure there are Linux alternatives as well (there *IS* a Linux version of Acrobat or at least Reader, right?) Anyone know of a winblows alternative to Reader?
Note Adobe will *eventually* fix this, so if you end up missing Reader after a few months you can check to see if they fixed this yet.
http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20090219
You have to go "out of your way" to install Adobe Reader, too. What's your point?
BHR> So the point is moot that you used it because of security flaws.
Foxit Reader doesn't use Adobe's code, so it doesn't contain this security flaw. And my question still stands: How many computers will be compromised in the time that it takes Adobe to release the patches for versions 9, 8, and 7?
BHR> Also, what does the average person on a Windows computer doing that this exploit will affect or effect their computer use?
I can think of a couple:
- They click on a link with an embedded PDF.
- They receive an e-mail with an attached PDF and open it.
Most people don't think of PDFs as being potentially dangerous.
Re-reading should be hyphenated.
I always question the credibility of anyone who posts under an alias. It shows cowardice.
Jay Converse
"Proofread" is one word.
xpdf, Foxit, OpenOffice, Preview on OSX...
...oh, wait - heh. :)
Quite funny actually
http://digitaldaily.allthingsd.com/20090220/heres-a-patch-for-you-adobe-acrobatuninstallexe/
I love you too... now put the sockpuppet away.
Thankfully he was true to form here. :)
A bit too early to have the smug look yet.
http://www.macworld.com/article/138943/2009/02/adobe_vulnerability.html?lsrc=rss_main
It's an Adobe exploit, not a platform one. ALL platforms are vulnerable. So you can put that smug look away - unless you use Preview to view pdf files.
;-)
Thanks for clarifying something that no one was confused about.
Simplest solution for now is to turn off Javascript in Acrobat 7 through 9 by going to "Preferences" look for the "Javascript" pane and then turn off "Enable Acrobat Javascript". When the flaw is patched undo that and you are golden (until the next flaw is found). Otherwise just leave it off and you won't miss much (other than some automated form filling which you probably don't use anyway).
Is this fundamentally a flaw in the Sun Java JRE? Meaning that a JRE update will (or could) block this exploit, regardless of what Adobe does? Also meaning that other apps could be exposed to this vulnerability?
Regarding turning off javascript "within" Acrobat - does this mean I can generally have javascript turned on (for other apps) but specifically turn it off for Acrobat?
Also - is Acrobat 6.x affected by this threat? (And don't say that Acrobat 6 is no longer supported, because that doesn't answer the question even if it is true).
- by redhotzz February 23, 2009 11:39 AM PST
- I needed Adobe Acrobat Reader and downloaded it last night. Within a few hours my free version of AVG threw up a window saying a threat was being stopped. I was gone all morning today and came home to a huge screen that said: C:\System volume Information\_restore{D534...Trojan Horse Generic 12.AQBH. NONE of the buttons on AVG do anything It. I came here to Cnet to check what might be going on and here is the Adobe Acrobat Reader blog. I 've uninstalled Adobe. AVG now wants $34.99 to use version8. Anyone else experience this? thanks ahead!
- Like this Reply to this comment
-
(36 Comments)