Feeds

Unofficial patch plugs 0-day Adobe security vuln.

Mind the gap

Securing Web Applications Made Simple and Scalable

Updated Security researchers have developed an unofficial patch for a zero-day Adobe Acrobat and Reader vulnerability that's become the subject of hacker attacks.

Adobe acknowledged the vulnerability last week but said an official patch wouldn't be available until 11 March.

This three week window of vulnerability before an update becomes available is all the more serious because hackers have created a exploit, Shadowserver reports. Malicious PDF's in circulation exploit a vulnerability in a function call not related to JavaScript. JavaScript is used in the malicious PDF but only to "fill the heap with shellcode" (ie to crank up the attack), Shadowserver explains.

In response to the threat, Sourcefire has released a "homebrew" patch against the vulnerability. The fix replaces a vulnerable DLL library file and weighs in at 10MB, even with compression. In addition it only works for Adobe Reader version 9. Version 8 is also vulnerable so surfers still using that version of the software will need to upgrade before even thinking about applying the unofficial patch.

The patch comes as Secunia warns here that contrary to previous reports, disabling javascript in Adobe Reader does not automatically prevent exploitation.

"During our analysis, Secunia managed to create a reliable, fully working exploit (available for Secunia Binary Analysis customers), which does not use javascript and can therefore successfully compromise users, who may think they are safe because javascript support has been disabled," Secunia writes.

Prospective users are urged to test this unofficial patch before applying the update. Deploying third party modified software into an environment carries greater risk than applying official patches, which are themselves capable of causing problems from time to time.

Unofficial patches have previously been released in the case of Microsoft vulnerabilities, most notably by the Zeroday Emergency Response Team. Unsanctioned security updates for application by other vendors is something of an innovation, however. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.