Adobe readies critical Reader update
Root cause of PDF complexity hairball remains
Adobe has promised to release a patch for a critical hole in its Adobe Reader and Acrobat PDF software next Tuesday (5 October).
The updates will address a zero-day cross-platform vulnerability first discovered three weeks ago that creates a possible mechanism for hackers to take over vulnerable PCs. The software developer plans to release Adobe Reader 9.3.4 for Windows, Macintosh and Unix, Adobe Acrobat 9.3.4 for Windows and Macintosh, and Adobe Reader 8.2.4 and Acrobat 8.2.4 for Windows and Macintosh next Tuesday a week ahead of its scheduled quarterly update, as explained in an advisory here.
Adobe plugged a related flaw in its Flash Player software with an out-of-sequence patch last week.
Anti-virus analyst Paul Baccas of Sophos Labs proposed replaceing PDF with a Safe Document Format during a presentation at the Virus Bulletin conference in Vancover on Thursday. Adobe plans to add sandboxing features to its Reader software, but Baccas said such a move does not go nearly far enough.
I never needed to create a PDF with 3D, flash or any other binary attachments... Nor I ever knew anyone else. I fact I have been asked many times why is that kind of functionality needed on PDF's.
So I'm left wondering if Adobe's owners do indeed have a lot of shares on AV companies.
That really is the best ever example of 90's "we did it because we could" development.
You would have to be a masochist to try and use it.
I worked around the problem by uninstalling Reader. Preview works OK on my Mac for the PDFs I have.