Adobe scripting flaw unearthed • The Register

Skip to content

Whitepapers

Adobe scripting flaw unearthed

Browser plug-in peril

By John Leyden • Get more from this author

Posted in Security, 4th January 2007 11:49 GMT

Free whitepaper – The starter PKI program

Users are advised to upgrade their Adobe Reader software following the discovery of a potential serious cross-site scripting bug. The vulnerability, which involves Adobe Reader 6.x and Adobe Reader 7.x, means it is possible to execute potential hostile JavaScript code simply by appending it to a PDF's URL.

The flaw, discovered by security researchers Stefano Di Paola and Giorgio Fedon and announced at the Chaos Communication Congress conference in Berlin this week, might be most easily exploited through Adobe Reader browser plug-ins. Users are advised to upgrade to Adobe Reader version 8.0 to defend against attack, or to apply workarounds as suggested by the SANS Institute's Internet Storm Centre here. ®

Free whitepaper – Securing your Microsoft Internet Information Services (MS IIS) web server

Whitepapers

The best practices guide for application security

Download to learn about the mandate, the business case, and the executive action plan to jump start an application security program.

Avoiding 7 common mistakes of IT security compliance

This guide covers seven typical IT security compliance errors and outlines the best practices you can immediately apply to your environment to help your company achieve compliance.

The starter PKI program

This guide will introduce you to our Starter PKI Program, explaining how it works as well as the benefits it offers. We’ll also point you to a dummy company on our Web site where you can “test drive” the Program.

Airport insecurity: the case of lost laptops

The steps you can take to protect the information on your employees’ laptops while they are on the road

The mandate for application security

Read this whitepaper to find out why rapidly evolving technologies like Web 2.0, outsourced development teams and compliance have created an urgent platform for application security.

Search more Resources

Top stories

Webcast: Jumpstart your Application Security initiatives

Don’t Miss

Google cloud told to encrypt itself

Updated R in RSA wants s in https

Buggy 'smart meters' open door to power-grid botnet

Grid-burrowing worm only the beginning

Chinese firm hits back at cyberspy claims

Exclusive Huawei welcomes UK.gov backdoor probe

BlockMaster SafeStick hardware-encrypted USB drive

Review Tough enough?