Hackers are targeting a zero-day vulnerability affecting Adobe Reader and Acrobat with malicious PDF files. Adobe officials say a fix for the issue will be available for Adobe Reader and Adobe Acrobat in the coming weeks. (This vulnerability has raised some concern of starting Adobe Connect meetings directly from PDF files.)
Hackers have once again turned to PDF files to spread their wares,
this time assaulting a zero-day flaw affecting Adobe Reader and Acrobat. Fortunately, the unpatched bug is
on the company’s radar, and fixes for Adobe Reader 9 and Acrobat 9 are slated to be available March 11. Updates for earlier
versions will come later, company officials said in an advisory. The bug is due to an error in the parsing of certain structures in PDF files. If exploited successfully, the bug could allow a hacker to take complete control of a vulnerable system. “In parsing a specially-crafted embedded object, a bug in the reader
allowed the attacker to overwrite memory at an arbitrary location,”
blogged McAfee researcher Geok Meng Ong. “The attacks, found in the
field, use the infamous heap spray method via JavaScript to achieve
control of code execution.” “While the distribution of this exploit thus far appears to be
targeted, new variants are expected as more information is made
public,” the researcher continued. “As with the Conficker experience,
the lack of good patch management is a very worrying trend that
deserves more attention from IT security practitioners. Adobe is
expected to release a patch very soon.” In the meantime, security researchers at the Shadowserver Foundation recommend users consider disabling JavaScript. Symantec also recommended Adobe users keep their antivirus up-to-date. “While we continue to investigate this issue, customers are advised
to follow best practices and only open email attachments from people
they trust,” blogged Symantec researcher Patrick Fitzgerald. “Enabling
DEP (Data Execution Prevention) for Adobe Reader will also help prevent
this type of attack.” Brian Prince: eWeek
Comments