TAG | Critical vulnerability in Adobe Reader |
|
| by Davey Winder | |
| Wednesday, 05 November 2008 | |
|
Core Security Technologies, a provider of proactive enterprise security testing solutions, has today issued a security advisory that discloses a critical vulnerability which has the potential to impact millions of users, both individuals and businesses, which rely upon the Adobe Reader PDF-file browsing software. Arguably the world’s most ubiquitous electronic document sharing application, Adobe Reader is used to view, search, digitally sign, verify, print, and collaborate on Adobe PDF files. It also, of course, contains the necessary scripting functionality to enable extended customization. The CoreLab engineers found that Adobe Reader was capable of being exploited to gain access to vulnerable systems using a specially crafted PDF file containing inevitable malicious JavaScript content. CoreLabs alerted Adobe to the vulnerability immediately, and both have been working to coordinate patch creation efforts. To successfully exploit this vulnerability requires a user to open that maliciously crafted PDF file which in turn allows the attacker to gain access to vulnerable systems, assuming the privileges of a user running Acrobat Reader. “As with many of today’s ubiquitous client side applications, the sheer complexity of Adobe Reader creates a broad surface for potential vulnerabilities and, in this case, Adobe’s inclusion of a fully-fledged JavaScript engine introduces the same types of implementation bugs commonly found in such sophisticated client side programs” said Ivan Arce, CTO at Core Security Technologies. It isn't the first exploit to impact upon Adobe users nor will it be the last. However, Adobe has issued a security update that addresses the vulnerable version 8.1.2 of Reader. Adobe Reader version 9, which was released in June 2008, is not vulnerable to the reported problem.
Get stories like this delivered daily - FREE - subscribe now
|
Tags
| < Next story in category | Previous story in the category > |
|---|
