New zero-day exploit targets Adobe Reader

[Airbot]

April 28, 2009 (Computerworld) Adobe Systems Inc. today confirmed that it's investigating reports that its popular PDF viewing software, Adobe Reader, contains a critical vulnerability.
A security researcher said that the bug is another in a long line of flaws in Adobe's implementation of JavaScript.
The bug was first disclosed yesterday on the SecurityFocus site, which posted a link to proof-of-concept attack code. "An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the application," said the advisory.
According to SecurityFocus, the most up-to-date versions, Reader 9.1 and Reader 8.1.4, are vulnerable. The Linux versions definitely have the bug, and versions for other platforms -- Adobe also provides Reader for Windows and the Mac -- may be at risk as well.

more: computerworld

 

[GreyWolf]

I find that type of attack rather useless. The only PDF's I ever access are my Electricity/Gas bill and user guides from well known websites.

I don't see how the average user can be tricked into opening a PDF from a malicious source.

 

[napilopez]

I find that type of attack rather useless. The only PDF's I ever access are my Electricity/Gas bill and user guides from well known websites.

I don't see how the average user can be tricked into opening a PDF from a malicious source.

The type of user that would open .exe's from email attachments =/

 

[garysgold]

Thanks Aaron. Good to know.

 

[Barman58]

Thanks for the Info Aaron

 

[Dwarf]

Cheers for the headup, Aaron.

 

[swarfega]

use Foxit Software - Foxit Reader for Windows instead

 

[Jacee]

Be sure to uncheck anything that comes bundled with Foxit Reader ... I think it was the "Ask" tool bar, the last time I downloaded it.

 

[swarfega]

yes definitely. Apart from that its a nice reader.

 

[jfar]

Thanks for the information.

 

[Adamd]

The type of user that would open .exe's from email attachments =/

Yeah way to many of those lol.

At least gmail does not allow you to send a .exe file.

But some times that gets in the way when I want to send a file to myself. O well.

 

[gaston]

use Foxit Software - Foxit Reader for Windows instead

That's the only way to go for me now. I use both the reader and the editor.

I used to like Adobe Reader back in the days before it became bloated and slow.

 

[FreakyFerret]

I can't even use Adobe Reader 9 at work. Or any of the latest Adobe products. I setup all my users with roaming profiles to simplify things for them and me. However none of the latest Adobe products (esp Reader 9.x) works with roaming! They all crash. Worse still no word from Adobe about when they're going to fix this or even if they care.

 

[Hammerhead786]

I can't even use Adobe Reader 9 at work. Or any of the latest Adobe products. I setup all my users with roaming profiles to simplify things for them and me. However none of the latest Adobe products (esp Reader 9.x) works with roaming! They all crash. Worse still no word from Adobe about when they're going to fix this or even if they care.

The latest version of Adobe Reader (9.1) works with roaming profiles. I' ve got roaming profiles and folder redirection in place and it worked for me. I have taken Adobe Reader off due to the zero day exploit and I'm using Foxit instead. For more info on the Adobe Reader issue see:

http://www.sevenforums.com/news/8092-new-zero-day-exploit-targets-adobe-reader.html

 

[kpo6969]

Adobe Announces Acrobat, Reader Fix

Adobe Announces Acrobat, Reader Fix - News and Analysis by PC Magazine

 

[FreakyFerret]

Hammerhead, how did you get it to work? I have roaming profiles and redirected folders on our network as well. Whenever I load Reader from a roaming profile, it crashes. If I load Reader from a local profile on the same machine, it works fine. I used Reader 9.0 and 9.1.

 

[Hammerhead786]

Hammerhead, how did you get it to work? I have roaming profiles and redirected folders on our network as well. Whenever I load Reader from a roaming profile, it crashes. If I load Reader from a local profile on the same machine, it works fine. I used Reader 9.0 and 9.1.

FreakyFerret, Sorry for the delay in getting back to you, I've just downloaded Adobe 9.1 Reader again and installed it on my Windows 7 pc. It loads up fine and I can open pdfs ok. I've done nothing out of the ordinary. Just accepted the defaults for installation. The account I'm using has folder re-direction in place and has a roaming profile.

Cheers,
Hamid

I know Reader 9 will definitely not work with folder re-direction. Only 9.1 does. I've also tested it with an account that has non admin privileges and it still works.

 

[Uber Philf]

cheers for the headsup aaron.

Enzo.

 

[neop26]

Foxit!! much easier on the sys and works quite well with 7. Thanks for the info though

 

[FreakyFerret]

Hammerhead, I tried 9.1 a couple of weeks ago. Maybe it was like 9.1.1 and you tried 9.1.2. I'll try it again next week when time allows. Thanks!