Adobe relieves Reader and Acrobat update blues
Plus fixes for 29 security bugs
Customer Success Testimonial: Recovery is Everything
Adobe Systems has introduced a new software updater for its Reader and Acrobat applications, one of several additions released Tuesday to protect users against a growing wave of malware attacks.
The new updater was included in in the latest versions of Reader and Acrobat, which Adobe released to fix almost 30 security vulnerabilities, at least one of which was already being targeted in limited attacks. For the time being, the feature will undergo testing in a closed beta program. Eventually, it will be rolled out to all users.
"The purpose of the new updater, once it is active, is to keep end-users up-to-date in a much more streamlined and automated way," Adobe's Steve Gottwals wrote here in announcing the addition.
The pilot should come as welcome news to anyone who has spent time toiling with the current updater. Under the best of cases, it checks only once every seven days to see if there's a new version of Reader, which is entirely inadequate given the frequency and ferocity of many exploits targeting the app. And even then the system, for reasons that still aren't clear, often fails to alert users when a new release is available.
Also introduced in Tuesday's update are features that give admins and end users more control over the types of code that can be executed by the widely deployed program. The controls allow Reader to block all javascript from running or to allow it to run just once in a single PDF document. Reader can also be configured so certain types of javascript commands are permanently blacklisted even while other types are allowed.
Over the past year, criminals have repeatedly used javascript "heap sprayers" to get around security protections such as address space layout randomization. While disabling javascript has provided some protection against these exploits, the move can also break features on websites and intranets. The increased granularity ought to help Adobe Reader strike a better balance between functionality and security.
The changes were introduced during Adobe's second quarterly update for Reader. The company implemented the regularly scheduled update routine to give admins more time to plan the patching of large fleets of machines. To make life easier, it coincides with Microsoft's Patch Tuesday.
In all, Tuesday's release fixed 29 security vulnerabilities, many of which Adobe rated as critical because they could be used to take control of vulnerable machines. While Reader and Acrobat for Windows was the only version that was under limited attack, Adobe warned many of the remote code execution flaws existed on the programs for Max OS X and Unix.
Updates for all platforms are here. For those who don't like excess software bloat, don't forget to uncheck the option to automatically download McAfee Security Scan. ®
COMMENTS
Thanks to all
Not only did venting my spleen here make me feel much better...but turned out to be truely helpful - Thanks all:
@The Beer Monster: Looked passed the 'Distribute Adobe Reader' link many times - so thanks for pointing this out. Still - don't see why I should need to fill out a "Adobe Reader Distribution Agreement" just to get hold of 'free' software that is available without the agreement via the installer. Also, why can't the Adobe Reader download page just have two links 'download with installer' and 'download full .exe file' ?!!
@Aunty Dan: Thanks for the link - but begs the question - Why don't Adobe publish this link on the front Reader download page? (And why should I bother with the "Adobe Reader Distribution Agreement" now ?
@Chris Beattie: Thanks for link - but again why do Adobe think I have time to 'hunt around' - after all I wouldn't need to p*** around downloading and installing if the software was secure to start with...
And HUGE thanks re Group Policy distribution etc. - haven't checked out your links yet but will be sure to do so.
My point regards 'patch Tuesday' was not why do they have a scheduled day (of course this makes sense rather than the 'we will release when we fancy it' approach) - but why the scheduled day is the same as MS's. Why not fourth Tuesday or something?
Best
@Andy Brown
"Still can't find a way to actually download the 9.2 exe - web site has a 'download' here link - but it isn't a download - it runs the installer prgram which downloads and installs."
Adobe usually provides a Reader installer for enterprise deployment, which does not include AIR or Acrobat.com, but you have to hunt around for it. It looks like 9.2 package that is being distributed is the enterprise version. Get the .msi instead of the .exe here:
ftp://ftp.adobe.com/pub/adobe/reader/win/9.x/9.2/enu/
"I have 45 PCs to update - I want to put the installion exe on a shared drive - not navigate to the adobe download page and download 30Mb EVERY TIME!"
You have more PCs than where software distribution systems start to be very handy. If you're not using one, you certainly need one. If you use Active Directory, set up a Group Policy for Reader installation. Adobe provides a document with instructions. You could probably set a Group Policy up from this document the first time in less time than it would take you to install Reader on five or ten PCs, especially if they're downloading the whole thing each time.:
http://www.adobe.com/devnet/acrobat/pdfs/gpo_ad_9.pdf
That's how I'm deploying Reader 9.2 to over 500 computers.
If you can do that, you may also find the customization wizard rather handy. You can set your Reader deployment to automatically accept the EULA, or disable Javascript, for instance:
http://www.adobe.com/support/downloads/detail.jsp?ftpID=3993
There's even a trick to use a Javascript file to hide menu items in Reader:
http://blog.stealthpuppy.com/deployment/deploying-adobe-reader-9-for-windows
"And why does Adobes new patch cycle concide with MSs cycle."
So that beleaguered admins know when the patches come out, as opposed to the previous method, where I usually found out there was a new patch when I was looking for something else. Deploying Reader versions is easy for me, and I much prefer this method.
Should hack Foxit
No, but if I did crack Foxit and load nasty infectious PDF onto all your PCs, I'd wipe the smug smiles off your smug faces, wouldn't I?
That's assuming that Foxit has exploitable bugs - less likely if there isn't Javascript, but possible - and that Foxit doesn't provide prompt security updates - well, small outfits don't, and I haven't heard of any.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
