Feeds

Malware spectre haunts Adobe Reader

PDF peril

Top three mobile application threats

Adobe Reader may be subject to a security hole that creates a means for hackers to take over vulnerable Windows boxes simply by opening a maliciously constructed PDF document.

Gray hat hacker Petko Petkov, who first discovered the bug, omits details of the supposed flaw. He said security concerns over the potency of the flaw alongside concerns over the time it might take for Adobe to come up with a fix have prompted him to hold back from publishing proof of concept code.

By way of illustration, a video clip published by Petkov depicts how Windows calculator starts when a PDF document is opened. The same approach might be used to launch a malicious payload.

Petkov verified the bug on Windows XP SP2 with the latest Adobe Reader 8.1, 8.0 and 7. Previous versions - as well as other PDF viewers - might also be affected. Windows Vista users, however, are projected against the attack, according to Petkov.

Although the warning over the attacks lacks details it comes from a source who's built up a strong reputation for unearthing security bugs. Petkov previously discovered bugs in the Second Life client and (more recently) Firefox's QuickTime plugin, Heise Security reports.

Security observers are taking the threat seriously. "PDF vulnerabilities have the strong potential to become a huge attack vector based on the social engineering aspect alone (people simply accept PDF files)," according to Paul Henry of Secure Computing. "This, coupled with the fact that nearly all technology solutions on the market are severely lacking in the capability to open and scan PDFs in-depth for malicious code, creates huge risk potential."

Caution about opening PDF files from unknown sources or websites is sensible, even though Petkov’s claims remain unverified. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Burnt out on patches this month? Oracle's got 104 MORE fixes for you
Mass patch for issues across its software catalog
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
Oracle working on at least 13 Heartbleed fixes
Big Red's cloud is safe and Oracle Linux 6 has been patched, but Java has some issues
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.