Adobe patches zero-day Reader flaw
Published: 11 Mar 2009 08:47 GMT
Adobe on Tuesday issued a security update to fix a critical vulnerability in Adobe Reader 9 and Acrobat 9 that could allow an attacker to take complete control of a computer, and for which exploits had been reportedly found in the wild for nearly two months.
Adobe alerted users about the vulnerability more than two weeks ago and promised to have a security update for it by 11 March.
The vulnerability means attackers can take advantage of a hole on unpatched systems to overwrite memory with a buffer overflow and install a backdoor through which to control the system remotely.
In its advisory, Adobe said it plans to provide security updates for Adobe Reader 7 and 8 and Acrobat 7 and 8 by 18 March, and for Adobe Reader 9.1 for Unix by 25 March.
Meanwhile, US-Cert said on Tuesday it is aware of public reports of two new attack vectors for the vulnerability involving the Windows Indexing Service that indexes PDF files and the Windows Explorer Shell Extension.
The vulnerability can be exploited with little or no user interaction if the Windows Indexing Service processes a malicious PDF file stored on the system, or if Windows Explorer displays a folder containing a malicious PDF file, the Cert advisory said.
Earlier in the day, Microsoft issued updates for a number of critical and important vulnerabilities in Windows as part of this month's Patch Tuesday.
One security expert complained that Adobe was late to acknowledge the vulnerability and uncommunicative about the issue since it arose.
"Having the patch early is a huge benefit, but releasing it on the same day as Microsoft's planned March patch spells disaster for enterprise resource planning, and it still leaves Adobe with a black eye for lack of communication," said Andrew Storms, director of security operations for nCircle, a network and compliance automation firm.
Adobe representatives did not immediately respond on Tuesday to phone calls and emails seeking comment.
Credit: Adobe issues fix for zero-day Reader vulnerability from CNET News
Did you find this article useful?
3 out of 3 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
