Feeds

Adobe relieves Reader and Acrobat update blues

Plus fixes for 29 security bugs

Providing a secure and efficient Helpdesk

Adobe Systems has introduced a new software updater for its Reader and Acrobat applications, one of several additions released Tuesday to protect users against a growing wave of malware attacks.

The new updater was included in in the latest versions of Reader and Acrobat, which Adobe released to fix almost 30 security vulnerabilities, at least one of which was already being targeted in limited attacks. For the time being, the feature will undergo testing in a closed beta program. Eventually, it will be rolled out to all users.

"The purpose of the new updater, once it is active, is to keep end-users up-to-date in a much more streamlined and automated way," Adobe's Steve Gottwals wrote here in announcing the addition.

The pilot should come as welcome news to anyone who has spent time toiling with the current updater. Under the best of cases, it checks only once every seven days to see if there's a new version of Reader, which is entirely inadequate given the frequency and ferocity of many exploits targeting the app. And even then the system, for reasons that still aren't clear, often fails to alert users when a new release is available.

Also introduced in Tuesday's update are features that give admins and end users more control over the types of code that can be executed by the widely deployed program. The controls allow Reader to block all javascript from running or to allow it to run just once in a single PDF document. Reader can also be configured so certain types of javascript commands are permanently blacklisted even while other types are allowed.

Over the past year, criminals have repeatedly used javascript "heap sprayers" to get around security protections such as address space layout randomization. While disabling javascript has provided some protection against these exploits, the move can also break features on websites and intranets. The increased granularity ought to help Adobe Reader strike a better balance between functionality and security.

The changes were introduced during Adobe's second quarterly update for Reader. The company implemented the regularly scheduled update routine to give admins more time to plan the patching of large fleets of machines. To make life easier, it coincides with Microsoft's Patch Tuesday.

In all, Tuesday's release fixed 29 security vulnerabilities, many of which Adobe rated as critical because they could be used to take control of vulnerable machines. While Reader and Acrobat for Windows was the only version that was under limited attack, Adobe warned many of the remote code execution flaws existed on the programs for Max OS X and Unix.

Updates for all platforms are here. For those who don't like excess software bloat, don't forget to uncheck the option to automatically download McAfee Security Scan. ®

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.