Adobe readies critical Reader update
Root cause of PDF complexity hairball remains
Adobe has promised to release a patch for a critical hole in its Adobe Reader and Acrobat PDF software next Tuesday (5 October).
The updates will address a zero-day cross-platform vulnerability first discovered three weeks ago that creates a possible mechanism for hackers to take over vulnerable PCs. The software developer plans to release Adobe Reader 9.3.4 for Windows, Macintosh and Unix, Adobe Acrobat 9.3.4 for Windows and Macintosh, and Adobe Reader 8.2.4 and Acrobat 8.2.4 for Windows and Macintosh next Tuesday a week ahead of its scheduled quarterly update, as explained in an advisory here.
Adobe plugged a related flaw in its Flash Player software with an out-of-sequence patch last week.
Anti-virus analyst Paul Baccas of Sophos Labs proposed replaceing PDF with a Safe Document Format during a presentation at the Virus Bulletin conference in Vancover on Thursday. Adobe plans to add sandboxing features to its Reader software, but Baccas said such a move does not go nearly far enough.