Feeds

Adobe Reader purged of hole that was under attack

22 other bugs also exterminated

Securing Web Applications Made Simple and Scalable

Adobe has patched 23 security vulnerabilities in its Reader document viewer, including one that criminals were exploiting to install malware on the PCs of unwitting victims.

At least 18 of the other flaws also made it possible for attackers to remotely hijack users' PCs, Adobe said in an bulletin released on Tuesday. The patch updates Reader and its sister application, Acrobat, to versions 9.4 and 8.2.5.

Adobe accelerated the release of the patch after researcher Mila Parkour uncovered a sophisticated attack circulating by email that exploited a stack overflow. The exploit was notable because it bypassed defensive protections Microsoft has built into more recent versions of Windows, such as ASLR, or address space layout randomization, and DEP, or data execution prevention. (The bypass was made possible by a programming mistake on Adobe's part.)

The booby-trapped PDF files, which were sent to select individuals and company employees, also contained three separate font packages so they worked on multiple versions of the Adobe programs. To allay victims' suspicions, the malware used a stolen digital certificate to sign some of its files.

Another vulnerability addressed in Tuesday's update actually resides in code associated with the Adobe Flash Player that's embedded in Reader and Acrobat. Attackers were exploiting the flaw in Flash until Adobe squashed the bug in that application last month. There are no reports so far that it was targeted in the company's PDF software.

It's been a tough couple of years for Adobe, which by many estimates is the second most attacked software maker behind Microsoft. With its highly complex code residing in the vast majority of the world's PCs, it allows exploit writers to maximize their profits.

Adobe has responded to the attacks by designing a security sandbox for Reader and Acrobat that will separate the applications' processes from the critical functioning of the underlying operating system. Of the dozen or so real-world attacks that have exploited vulnerabilities in Reader over the past few years, none of them would have succeeded against the application had it employed the sandbox, Adobe's senior director of product security and privacy, Brad Arkin, said in July.

The feature, to be called Adobe Reader Protected Mode, will be included in the next major release of the application, which is due out before the end of the year. Adobe's Kyle Randolph released an initial round of technical details about the new design on Tuesday here.

Building a sandbox into an application as complex as Reader has been compared by some to adding a basement to a 20-story building after it's already been erected. Versions 7 and 8 of Internet Explorer have a similar feature, and so does Google's Chrome browser.

Adobe's plans to follow suit shows it is making good on its promise to make its users safer. One area where the company can still improve is its warning to those updating Reader and Flash that they may need to temporarily disable their anti-virus software. This kluge puts users at risk. It's time Adobe developers fixed it. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.