Feeds

Malware spectre haunts Adobe Reader

PDF peril

Boost IT visibility and business value

Adobe Reader may be subject to a security hole that creates a means for hackers to take over vulnerable Windows boxes simply by opening a maliciously constructed PDF document.

Gray hat hacker Petko Petkov, who first discovered the bug, omits details of the supposed flaw. He said security concerns over the potency of the flaw alongside concerns over the time it might take for Adobe to come up with a fix have prompted him to hold back from publishing proof of concept code.

By way of illustration, a video clip published by Petkov depicts how Windows calculator starts when a PDF document is opened. The same approach might be used to launch a malicious payload.

Petkov verified the bug on Windows XP SP2 with the latest Adobe Reader 8.1, 8.0 and 7. Previous versions - as well as other PDF viewers - might also be affected. Windows Vista users, however, are projected against the attack, according to Petkov.

Although the warning over the attacks lacks details it comes from a source who's built up a strong reputation for unearthing security bugs. Petkov previously discovered bugs in the Second Life client and (more recently) Firefox's QuickTime plugin, Heise Security reports.

Security observers are taking the threat seriously. "PDF vulnerabilities have the strong potential to become a huge attack vector based on the social engineering aspect alone (people simply accept PDF files)," according to Paul Henry of Secure Computing. "This, coupled with the fact that nearly all technology solutions on the market are severely lacking in the capability to open and scan PDFs in-depth for malicious code, creates huge risk potential."

Caution about opening PDF files from unknown sources or websites is sensible, even though Petkov’s claims remain unverified. ®

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?