Stephen Withers
Thursday, 26 February 2009 09:10
Opinion and Analysis
Page 2 of 3
Secondly, there's a vulnerability in Adobe Reader and Acrobat. Malicious PDF files can use this to get up to no good - one exploit installs a remote access backdoor on Windows systems.
One partial workaround is to disable JavaScript in the programs' preferences, while others merely prevent the automatic display of PDFs.
The problem is that the underlying vulnerability can be exploited without resorting to JavaScript.
It appears that Reader 9 and earlier and Acrobat 9 and earlier are affected by the vulnerability, and Adobe doesn't qualify this with reference to specific platforms. The company plans to release an update by March 11 (the day after Microsoft's Patch Tuesday).
The bad news for Mac users is that
Intego has determined that the PDF handling code in Mac OS X 10.5 also has this vulnerability. That means it could be exploited by a PDF that's opened in Preview, Safari, Mail or even Quick Look.
There's no known Mac exploit for this issue, but opening PDF files is such a commonplace activity that it does present a worry.
Not opening PDFs is hardly an option, so its fortunate that many desktop and gateway security products now provide protection against attacks targeting this vulnerability.
The third flaw is in another Adobe product - find out which on
page 3.
