Feeds

Malware spectre haunts Adobe Reader

PDF peril

Protecting against web application threats using SSL

Adobe Reader may be subject to a security hole that creates a means for hackers to take over vulnerable Windows boxes simply by opening a maliciously constructed PDF document.

Gray hat hacker Petko Petkov, who first discovered the bug, omits details of the supposed flaw. He said security concerns over the potency of the flaw alongside concerns over the time it might take for Adobe to come up with a fix have prompted him to hold back from publishing proof of concept code.

By way of illustration, a video clip published by Petkov depicts how Windows calculator starts when a PDF document is opened. The same approach might be used to launch a malicious payload.

Petkov verified the bug on Windows XP SP2 with the latest Adobe Reader 8.1, 8.0 and 7. Previous versions - as well as other PDF viewers - might also be affected. Windows Vista users, however, are projected against the attack, according to Petkov.

Although the warning over the attacks lacks details it comes from a source who's built up a strong reputation for unearthing security bugs. Petkov previously discovered bugs in the Second Life client and (more recently) Firefox's QuickTime plugin, Heise Security reports.

Security observers are taking the threat seriously. "PDF vulnerabilities have the strong potential to become a huge attack vector based on the social engineering aspect alone (people simply accept PDF files)," according to Paul Henry of Secure Computing. "This, coupled with the fact that nearly all technology solutions on the market are severely lacking in the capability to open and scan PDFs in-depth for malicious code, creates huge risk potential."

Caution about opening PDF files from unknown sources or websites is sensible, even though Petkov’s claims remain unverified. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.