Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Adobe patches under-attack Reader bug

Ships emergency update to plug a hole hackers have exploited for weeks using rigged PDFs

Adobe today issued an emergency update for its popular Reader PDF software that patched two critical vulnerabilities, including one attackers have exploited for weeks.

The more notable flaw fixed in Reader 9.4.1 for Windows and Mac OS X was a bug that hackers have been leveraging since late October using malicious PDF documents. Those attacks have taken advantage of a flaw in Reader's "authplay" component. Authplay is the interpreter that renders Flash content embedded within PDF files.

Successful attacks have dropped a Trojan horse and other malware on victimized Windows PCs.

Authplay has been targeted by malware makers several times this year, most recently in June. Then, Adobe shipped an emergency patch for Flash Player within a week, and followed with a fix for Reader and Acrobat two weeks later.

Adobe followed the same general timeline this time, patching Flash Player first on Nov. 4, then Reader and Acrobat today.

Adobe has defended its two-stage patching -- which some have questioned because active authplay exploits are typically aimed at Reader, not Flash -- by explaining that the fix was first crafted by its Flash development team. The patched "authoplay.dll" file was then handed off to the Reader group to integrate and test with their product.

The second vulnerability addressed Tuesday had been disclosed on the Full Disclosure security mailing list earlier this month. At the time, Adobe said that the flaw could be used to crash Reader, but not Acrobat, and said it was unsure whether an exploit could compromise a computer running the PDF program.

Adobe repeated that analysis today. "These updates resolve a memory corruption vulnerability that could potentially lead to code execution," the company said in an advisory accompanying the updates.

Although Adobe tries to hew to a quarterly patch schedule for Reader and Acrobat, at times it's scuttled those plans to issue rush fixes for critical bugs. That wasn't the case here: Adobe made it a point to remind users that it will still release its next regularly-scheduled Reader update on Feb. 8, 2011.

Only the Windows and Mac versions of Reader and Acrobat were patched today. An updated Reader for Linux/Unix won't ship until Nov. 30. Adobe also postponed a patch for the older Adobe 8.x, which is vulnerable to the second bug.

"Adobe plans to address Adobe Reader version 8.x in the next release," the advisory read.

Neither bug affected the Android version of Reader that Adobe launched in August.

Reader was last patched Oct. 5 in a 23-fix update one security expert called a "double-whammy."

Adobe Reader and Acrobat for Windows and Mac OS X can be downloaded using the links included in Tuesday's advisory. Alternately, users can call up the programs' built-in update mechanisms to grab the new versions.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: Adobe, Linux
References show all

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CIO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: security
Latest Blog Posts
Whitepapers
  • Forrester Research | Your Enterprise Database Security Strategy 2010
    With increasingly sophisticated attacks and rising internal data theft, database security merits a stronger focus that goes beyond traditional authentication, authorization, and access control. Learn how to secure your database - Read this strategy guide.
    Learn more »
  • Teleworking made simple—and secure—with desktop virtualisation technology
    Businesses of all sizes are increasingly focused on creating flexible work environments and offering telework options for employees. By administering policies and providing the technical capability for employees to work remotely, these companies can improve job satisfaction and worker attraction and retention. This paper explores the implementation of teleworking based on a foundation of desktop and server virtualisation.
    Learn more »
  • 10 Ways to Stretch your storage budgets in virtualised, consolidated environments
    Everyone’s heard the line about the only inevitabilities in life being death and taxes. IT managers, however, would quickly assert a third absolute – higher storage needs. There’s no question data storage requirements continue to skyrocket, and there’s absolutely zero likelihood of that ending any time in our lifetime. Enterprises have successfully controlled their IT budgets and server sprawl issues with the help of virtualisation technologies, but what’s next? Increasingly, organizations are turning to storage consolidation for virtualised server environments in order to reduce data center costs and inefficiencies.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments