Adobe’s Reader And Flash Installing Software Can Install Malware
A researcher has unearthed a bug in software used to install Adobe’s ubiquitous Reader and Flash applications that can be exploited to remotely install malicious files on end user PCs.
The Adobe Download Manager is an ActiveX script that is invoked when people install or update Reader or Flash using Internet Explorer. Researcher Aviv Raff has figured out how to exploit it to install any file he wishes simply by tricking a user into clicking on a link on the Adobe.com domain.
The attack combines a vulnerability on Adobe’s website with a defect in the download manager. The result: he was able to install and execute his own instance of the Windows calculator on a Register test machine. Aviv demonstrated the exploit on the condition further technical details be withheld.
“Instead of admitting that this design flaw is indeed a problem which can be abused by malicious attackers, Adobe decided to downplay this issue,” Raff wrote. He was referring to unpublished comments an Adobe spokeswoman made to Zero Day blogger Ryan Naraine.
In part, the comments said the download manager “is designed to remove itself from the computer after use at the next restart,” “can only be used to download the latest version of software hosted on Adobe.com,” and “presents a very large user dialog box when downloading software.”
But because the download manager remains on a machine until it is rebooted, attackers have ample opportunity to exploit the bug. Assuming the typical machine is restarted once every 24 to 72 hours, attacks have a reasonable chance of success as long as they are launched within the first one to three days of a recent update. (We’re guessing a fair percentage of people would be unfazed by the dialog box).
And once that happens, attackers have the ability to remotely install malicious code on an untold millions of PCs.
In response to Raff’s post, Adobe spokeswoman Wiebke Lips wrote: “Adobe is aware of the recently posted report of a remote code execution vulnerability in the Adobe Download Manager. We are working with the researcher, Aviv Raff, and the third party vendor of this component to investigate and resolve the issue as quickly as possible.”
The myriad bugs that over the past few years have routinely imperiled the entire internet have made Adobe the Toyota of the software industry. Company security personnel seem intent of correcting the problems, but the only way for that to happen is to launch a comprehensive initiative that makes a top-to-bottom review of the company’s entire code base.
Credit: The Register
More on CyberInsecure:
Posts
February 21st, 2012 at 1:36 pm
I had a machine at work that was struck with a vicious redirect virus. I kept trying to restore back to before the virus, and the only change was that I had an adobe update asking to be installed. I suspected the update was installing the redirect virus. This was in 2011/December.
This week, I noticed I was getting a redirect virus on a home computer. This also started happening after an adobe update request appeared. Again, I suspect that the adobe update installed a redirect. This is 2012/February.
Of course, I can prove neither, only suspsect.
March 7th, 2012 at 6:49 am
Yeah, two things:
1. Do not use Adobe Reader, use Foxit Reader instead (http://www.foxitsoftware.com/Secure_PDF_Reader/).
2. Install Flash updates manually, only by visiting http://get.adobe.com/flashplayer. No automatic pop-ups when Windows starts, no clicking links in emails.