Critical Adobe Reader Vulnerability Under Attack, Allows Complete Control Of User’s Computer
Attackers once again are targeting an unpatched vulnerability in Adobe Reader that allows them to take complete control of a user’s computer, the software maker warned.
Adobe said it planned to patch the critical security bug in Reader and Acrobat 9.1.3 for Windows, Mac and Unix on Tuesday, the date of the company’s previously scheduled patch release for the PDF reader. According to Security Focus here, attackers can exploit the vulnerability by tricking a user into opening a booby-trapped PDF file.
“Successful exploits may allow the attacker to execute arbitrary code in the context of a user running the affected application,” the security site warned. “Failed attempts will likely result in denial-of-service conditions.”
The bug is presently being exploited in “limited targeted attacks,” Security Focus added, without elaborating. Adobe said only that the attacks target Reader and Adobe running on Windows operating systems.
Those using Windows Vista with a feature known as data execution prevention enabled are safe from the exploit. Users on other platforms can insulate themselves from the current attack by disabling javascript from running inside the application, but Adobe warned it’s possible to design an exploit that works around that measure.
The company said it’s working with anti-virus providers so their software can detect the PDF files that target the bug.
This is at least the third time this year that criminals have targeted an unpatched vulnerability in Adobe Reader or Flash, which arguably are installed on a larger base of machines than any Microsoft software. The company has taken flak not just for releasing buggy programs, but for taking too long to fix security flaws once they’re discovered. The company in May promised to reinvigorate its security program for Reader.
To disable javascript from running inside the application, choose Preferences from Reader’s Edit menu, highlight javascript and then uncheck the box that says “Enable Acrobat JavaScript.” Another good idea would be completely uninstalling the Reader and using a much safer, less bloated alternative like Foxit Reader.
Credit: The Register
More on CyberInsecure:
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.